Few fields not visible when check on the all feilds section but i can see them when i table them with the names.

[HarishSamudrala]

I have a strange issue, when i search for specific event in Splunk and I am looking for specific fields( ex field1, field2) i can not see them in selected fields and interested fields.

But, when i run the same query and table those fields , i can see them. 

index=1234 sourcetype=4567 --> can not see those fields when this search is triggered. But when i add a table command with those field names in the search i can see the fields and the values for them.

index=1234 sourcetype=4567 | table field1, field2 --> this query i can see the fields.

Did any one face this issue ? We are on latest Splunk version 9.0.X..

[HarishSamudrala]

Hi @richgalloway ,

Thanks for you inputs on this. 

We are running the search in verbose mode only, but this did no help us. The event we are dealing with is very big and we are thinking if Splunk is hitting any limitation in showing up all the fields in the left side panel selected fields and interested fields.

[richgalloway]

How big are the events?  Splunk default to 200 field extractions, IIRC.  Also, what type of data is it?  I've seen problems extracting JSON data, especially nested JSON.

[isoutamo]

Hi

This could be the reason. Just hunting this kind of issues and still working with it.

You should look limits.conf and it's kv-stanza. Also check what you have on your sourcetype (and/or host and source) definition's TRUNCATE value. Both of those are affecting how many fields splunk automatically found.

r. Ismo

[gcusello]

Hi @HarishSamudrala ,

in addition to the hint of @richgalloway , remember that in interesting fields you see only the fields present in at least 20% of the events, probably these fields have a minor percentage.

Instead running a search with these fields (e.g. field1=*), they are present at the 100% of the events.

If you open the "All fields" panel, you can see fields present (by default) in more than 1% of the events and you can use also a filter to have all the fields without a threshold

Ciao.

Giuseppe

[HarishSamudrala]

hi @gcusello ,

Thanks for your inputs on this. 

Yeah , we have validated that "All fields" are selected in the fields drop down.  We are running the search in verbose mode.

But, nothing helped...out event is very big and i am thinking if there is any limitation Splunk is hitting in showing up the fields. 

[richgalloway]

Make sure you're running the search in Verbose mode.  In Smart mode, Splunk only extracts fields explicitly referenced in the query.