How to achieve field enrichment in Splunk results?

[Seeker]

When I run a search query I see that there are some fields which are present in interesting fields but not present in the event results. How is that achieved?

[PickleRick]

Interesting fields show all fields that are present in at least 20(? I don't remember exactly) percent of the resulting events. Maybe those events are not shown on the first page ofmthe results. Why do you say that they're not present in your events? Remember that only selected fields show in results list. To see all extracted fields you have to expand single event.

[Seeker]

The expanded events do not have the  "Environment" field but the Interesting field has the environment field. I checked the extracted fields and could not find the Environment field being extracted.

So, my question is how would Splunk get to know the field name "Environment" and its value. Also whatever value is getting populated for "Environment" field is not present in the event. So, how this can happen? Could this be happening via Index somehow? 

[PickleRick]

Interesting fields will show you number of occurrences next to a field name. It's really hard to believe that a field not present in (or with - there can be in some special cases some indexed fields not contained within the event data, or calculated from) the event since - by definition https://docs.splunk.com/Documentation/SplunkCloud/9.0.2209/SearchTutorial/Usefieldstosearch they must be present in 20% of results to be shown.

[gcusello]

Hi @Seeker,

surely there are some field extractions or field alias or calculated fields.

See in [Settings > Fields] if there are occurrences for the sourcetype you're using.

Ciao.

Giuseppe

[Seeker]

I checked all three settings for fields but did not see setting related to the fields I am seeing in interesting fields. Is there any other way to enrich the search results in the background by some another process?

[gcusello · Accepted solution]

Hi @Seeker,

I forgot that there are also automatic lookup that gives you more fields.

Anyway, in intersting fields (as @PickleRick said) as sgown only fields with more than 20% of results, to see all fields you have to choose the All field option.

Ciao.

Giuseppe

[Seeker]

Got it. I see it's working now. The magic was created by an "Automatic Lookup". It's hidden in the settings and I never knew it was enriching the search results silently.

Thanks for sharing multiple helpful "what it could be" @PickleRick @gcusello and also helping with the exact solution.