How to add fields to "selected fields" from the event. Some fields, such as name and sc_pl, are missing in the selected fields.
I am not sure if this will work for you or not. You can try by deleting the Field Aliases.
Below is the answer for the same issue:-
https://answers.splunk.com/answers/693737/splunk-720-field-aliases-incorrect-behavior.html
In screensot select All fields. And no filters
Hi Fridays,
How are you searching your fields?
If you want to see all selected fields you need to search it in verbose mode and also make sure the coverage selected is "All Fields"
Click on the All Fields
link in the left-most panel under the histogram. Any field that has a checkmark will be a SELECTED FIELD
.
It is relatively dynamic and will only show those fields that exist in your current search results. To get those other fields available, run a search that returns results with those fields (or just do something like | eval serv = "foo"
.
Hi fridays,
you can go to "All Fields" and from there you can select the required fields of your interest(check the box for the field you want).
Hope it helps!
Thanks