All Apps and Add-ons

Interesting fields disappear as number of events returned is increased

alanzchan
Path Finder

For example, here is data from the last 60 minutes. Less events are returned and the index, source, and sourcetype fields are still there.
alt text

However, when I search for events from the last 24 hours, the index, source, and sourcetype fields dissappears.

alt text

I'm already searching in verbose mode and looking at all fields as well so this is not the issue. I think there is some limits configuration that I should set to prevent this from happening. Has anyone experienced this or have any suggestions?

0 Karma

woodcock
Esteemed Legend

The only way for the fields to disappear is if something made them disappear (like a calculated field).

0 Karma

alanzchan
Path Finder

Calculated fields are fields added to events at search time. I'm not doing any calculated fields. Events are coming in via HEC with index already defined in the outputs of the fluentd agent.

0 Karma

woodcock
Esteemed Legend

Click on the All Fields link and make sure that the fields that you care about are selected (or select them). There is a concept called viewstate that controls this but the gist is that the selected fields are more-or-less supposed to follow you around, provided the fields exist (and the ones that you listed should always exist).

0 Karma

alanzchan
Path Finder

I don't think this is the issue. I'm already searching in verbose mode and I've looked in All Fields (including setting the coverage to All Fields). The fields just disappear. The indexes are still searchable, but it just doesn't show up in the list.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...