How to get extracted fields when searching using the REST API ?

[mlrhazi]

When I search using the Python SDK, I don't seem to see any fields, other than the very basic ones like host, source, sourcetype... in the results. Is there a way to get the search to return all the same pre-extracted fields I get when using the splunk search GUI ? like fields automatically extracted by Splunk, such as those that come in field1=value1 ...etc?

Thanks,

Mohamed.

[soiram]

rf=* for all fields

[scelikok]

Hi @mlrhazi,

Splunk REST API does not extract fields like GUI. You should specify the required fields by rf (or required_fields on older versions) parameter. Please see the below documentation. 

https://docs.splunk.com/Documentation/Splunk/9.0.3/RESTTUT/RESTsearches#Tips_on_creating_searches