Splunk Search

Fields through REST API

klbiggs
Engager

When using the REST API through a Java application I only receive fields that I explicitly search for (e.g. "5109483394 | fields Number, Location, LogType"). I have set up these fields in transforms.conf and this works using the Search app without having to specifically search for the fields (e.g "5109483394"). Is there anyway to set this fields to show up without directly searching for them?

1 Solution

sideview
SplunkTrust
SplunkTrust

Splunk will not extract or persist fields by default if the search parser tells it that the given fields are not referenced in the search language anywhere.

You can of course trigger the extraction by tacking on a fields command as you've discovered:

<your search> | fields someDesiredField anotherDesiredField 

As far as a more general solution, you can tack on fields * to tell it to extract every field.

And at the API level, you can also send required_field_list=* on the POST when you dispatch the job.

Be aware that when you search with fields * or submit with the API arg required_field_list set to *, your searches will incur a what can be a significant performance drain, as every possible extraction will be run.

(as to why the default search UI always has every field, the presence of the FieldPicker module in the view XML triggers a change to where all searches get dispatched with the REST arg required_field_list=*. To come full circle, when you turn off 'automatic field discovery' in the UI, what's happening is it then falls back to submitting required_field_list=<just the selected fields please>)

In general if you're using the REST API you really should become as familiar with status_buckets and required_field_list sooner rather than later because behavior can be quite counterintuitive.

http://www.splunk.com/base/Documentation/4.2.1/Developer/RESTSearch

View solution in original post

sideview
SplunkTrust
SplunkTrust

Splunk will not extract or persist fields by default if the search parser tells it that the given fields are not referenced in the search language anywhere.

You can of course trigger the extraction by tacking on a fields command as you've discovered:

<your search> | fields someDesiredField anotherDesiredField 

As far as a more general solution, you can tack on fields * to tell it to extract every field.

And at the API level, you can also send required_field_list=* on the POST when you dispatch the job.

Be aware that when you search with fields * or submit with the API arg required_field_list set to *, your searches will incur a what can be a significant performance drain, as every possible extraction will be run.

(as to why the default search UI always has every field, the presence of the FieldPicker module in the view XML triggers a change to where all searches get dispatched with the REST arg required_field_list=*. To come full circle, when you turn off 'automatic field discovery' in the UI, what's happening is it then falls back to submitting required_field_list=<just the selected fields please>)

In general if you're using the REST API you really should become as familiar with status_buckets and required_field_list sooner rather than later because behavior can be quite counterintuitive.

http://www.splunk.com/base/Documentation/4.2.1/Developer/RESTSearch

Get Updates on the Splunk Community!

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...