Splunk Search

Fields through REST API

klbiggs
Engager

When using the REST API through a Java application I only receive fields that I explicitly search for (e.g. "5109483394 | fields Number, Location, LogType"). I have set up these fields in transforms.conf and this works using the Search app without having to specifically search for the fields (e.g "5109483394"). Is there anyway to set this fields to show up without directly searching for them?

1 Solution

sideview
SplunkTrust
SplunkTrust

Splunk will not extract or persist fields by default if the search parser tells it that the given fields are not referenced in the search language anywhere.

You can of course trigger the extraction by tacking on a fields command as you've discovered:

<your search> | fields someDesiredField anotherDesiredField 

As far as a more general solution, you can tack on fields * to tell it to extract every field.

And at the API level, you can also send required_field_list=* on the POST when you dispatch the job.

Be aware that when you search with fields * or submit with the API arg required_field_list set to *, your searches will incur a what can be a significant performance drain, as every possible extraction will be run.

(as to why the default search UI always has every field, the presence of the FieldPicker module in the view XML triggers a change to where all searches get dispatched with the REST arg required_field_list=*. To come full circle, when you turn off 'automatic field discovery' in the UI, what's happening is it then falls back to submitting required_field_list=<just the selected fields please>)

In general if you're using the REST API you really should become as familiar with status_buckets and required_field_list sooner rather than later because behavior can be quite counterintuitive.

http://www.splunk.com/base/Documentation/4.2.1/Developer/RESTSearch

View solution in original post

sideview
SplunkTrust
SplunkTrust

Splunk will not extract or persist fields by default if the search parser tells it that the given fields are not referenced in the search language anywhere.

You can of course trigger the extraction by tacking on a fields command as you've discovered:

<your search> | fields someDesiredField anotherDesiredField 

As far as a more general solution, you can tack on fields * to tell it to extract every field.

And at the API level, you can also send required_field_list=* on the POST when you dispatch the job.

Be aware that when you search with fields * or submit with the API arg required_field_list set to *, your searches will incur a what can be a significant performance drain, as every possible extraction will be run.

(as to why the default search UI always has every field, the presence of the FieldPicker module in the view XML triggers a change to where all searches get dispatched with the REST arg required_field_list=*. To come full circle, when you turn off 'automatic field discovery' in the UI, what's happening is it then falls back to submitting required_field_list=<just the selected fields please>)

In general if you're using the REST API you really should become as familiar with status_buckets and required_field_list sooner rather than later because behavior can be quite counterintuitive.

http://www.splunk.com/base/Documentation/4.2.1/Developer/RESTSearch

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

Tech Talk Recap   From Chaos to Control: Scaling Splunk Cloud with Infrastructure as Code Managing apps in ...