SELECTED FIELDS

[fridays]

How to add fields to "selected fields" from the event. Some fields, such as name and sc_pl, are missing in the selected fields.

[fridays]

no fields.

[fridays]

This is All Fields. In splunk 6.5 all fields were in place. The problem appeared after the update on the splank 7.2.4

[MoniM]

I am not sure if this will work for you or not. You can try by deleting the Field Aliases.

Below is the answer for the same issue:-
https://answers.splunk.com/answers/693737/splunk-720-field-aliases-incorrect-behavior.html

[fridays]

In screensot select All fields. And no filters

[nikita_p]

Hi Fridays,
How are you searching your fields?
If you want to see all selected fields you need to search it in verbose mode and also make sure the coverage selected is "All Fields"

[MoniM]

Hi @fridays ,
One of the reason for this is the coverage percentage.
please find below snap for the setting in your "All Fields tab".

[woodcock]

Click on the All Fields link in the left-most panel under the histogram. Any field that has a checkmark will be a SELECTED FIELD.

[fridays]

"All fields" - do not include all fields. No serv, name and other fields.

[woodcock]

It is relatively dynamic and will only show those fields that exist in your current search results. To get those other fields available, run a search that returns results with those fields (or just do something like | eval serv = "foo".

[MoniM]

Hi fridays,
you can go to "All Fields" and from there you can select the required fields of your interest(check the box for the field you want).

Hope it helps!
Thanks