Disable Field Discovery

[Ron_Naken]

In 4.2, we have the ability to click the Field Discovery button to ask Splunk to extract only necessary fields for a search -- similar to using a fields command, but automated. Is there a way to set this in the search syntax so that one could make saved searches -- or searches in knowledge objects -- that run in the OFF state, by default?

At present, if you click Field Discovery to OFF for a search, then save it, Field Discovery is re-enabled as soon as you run the saved search.

Thanks,
Ron

[Stephen_Sorkin · Accepted solution]

You can't change the toggle via the search language, but you can achieve the same effect by using "| fields ..." to pick only the fields that you care about for your search. This will give you the same speedup as disabling the automatic field extractor.

[gkanapathy · Accepted solution]

Note that the field discovery this affects searches in the flashtimeline view, but not scheduled saved searches or searches run on custom dashboards. Those searches do not do the automatic field discovery and in fact optimize out any non-required fields. You can do what you want as Stephen says, by using the fields command in the search string, but note that it's only needed on the flashtimeline view (or similar derivatives).

[Stephen_Sorkin · Accepted solution]

You can't change the toggle via the search language, but you can achieve the same effect by using "| fields ..." to pick only the fields that you care about for your search. This will give you the same speedup as disabling the automatic field extractor.