Splunk Search
Highlighted

Disable Field Discovery

Splunk Employee
Splunk Employee

In 4.2, we have the ability to click the Field Discovery button to ask Splunk to extract only necessary fields for a search -- similar to using a fields command, but automated. Is there a way to set this in the search syntax so that one could make saved searches -- or searches in knowledge objects -- that run in the OFF state, by default?

At present, if you click Field Discovery to OFF for a search, then save it, Field Discovery is re-enabled as soon as you run the saved search.

Thanks,
Ron

Tags (2)
Highlighted

Re: Disable Field Discovery

Splunk Employee
Splunk Employee

You can't change the toggle via the search language, but you can achieve the same effect by using "| fields ..." to pick only the fields that you care about for your search. This will give you the same speedup as disabling the automatic field extractor.

View solution in original post

Highlighted

Re: Disable Field Discovery

Splunk Employee
Splunk Employee

Note that the field discovery this affects searches in the flashtimeline view, but not scheduled saved searches or searches run on custom dashboards. Those searches do not do the automatic field discovery and in fact optimize out any non-required fields. You can do what you want as Stephen says, by using the fields command in the search string, but note that it's only needed on the flashtimeline view (or similar derivatives).

View solution in original post