Splunk Search

Fields through REST API

klbiggs
Engager

When using the REST API through a Java application I only receive fields that I explicitly search for (e.g. "5109483394 | fields Number, Location, LogType"). I have set up these fields in transforms.conf and this works using the Search app without having to specifically search for the fields (e.g "5109483394"). Is there anyway to set this fields to show up without directly searching for them?

1 Solution

sideview
SplunkTrust
SplunkTrust

Splunk will not extract or persist fields by default if the search parser tells it that the given fields are not referenced in the search language anywhere.

You can of course trigger the extraction by tacking on a fields command as you've discovered:

<your search> | fields someDesiredField anotherDesiredField 

As far as a more general solution, you can tack on fields * to tell it to extract every field.

And at the API level, you can also send required_field_list=* on the POST when you dispatch the job.

Be aware that when you search with fields * or submit with the API arg required_field_list set to *, your searches will incur a what can be a significant performance drain, as every possible extraction will be run.

(as to why the default search UI always has every field, the presence of the FieldPicker module in the view XML triggers a change to where all searches get dispatched with the REST arg required_field_list=*. To come full circle, when you turn off 'automatic field discovery' in the UI, what's happening is it then falls back to submitting required_field_list=<just the selected fields please>)

In general if you're using the REST API you really should become as familiar with status_buckets and required_field_list sooner rather than later because behavior can be quite counterintuitive.

http://www.splunk.com/base/Documentation/4.2.1/Developer/RESTSearch

View solution in original post

sideview
SplunkTrust
SplunkTrust

Splunk will not extract or persist fields by default if the search parser tells it that the given fields are not referenced in the search language anywhere.

You can of course trigger the extraction by tacking on a fields command as you've discovered:

<your search> | fields someDesiredField anotherDesiredField 

As far as a more general solution, you can tack on fields * to tell it to extract every field.

And at the API level, you can also send required_field_list=* on the POST when you dispatch the job.

Be aware that when you search with fields * or submit with the API arg required_field_list set to *, your searches will incur a what can be a significant performance drain, as every possible extraction will be run.

(as to why the default search UI always has every field, the presence of the FieldPicker module in the view XML triggers a change to where all searches get dispatched with the REST arg required_field_list=*. To come full circle, when you turn off 'automatic field discovery' in the UI, what's happening is it then falls back to submitting required_field_list=<just the selected fields please>)

In general if you're using the REST API you really should become as familiar with status_buckets and required_field_list sooner rather than later because behavior can be quite counterintuitive.

http://www.splunk.com/base/Documentation/4.2.1/Developer/RESTSearch

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...