How can we show all fields, including rare ones?

[danielbb]

I'm running -

index=<indexname> | fields

or

index=<indexname> | fieldsummary

They don't show the fields which are very rare in the content. Is there a way to see all fields even if they exist in a very small percentage of the events?

[woodcock]

You need to run your search in Verbose mode.

[danielbb]

No luck @woodcock - running in Verbose mode for the past 24 hours index=<indexname>| fieldsummary didn't show the field whereas index=<indexname> XXXPassword | fieldsummary shows it.

And as we said, XXXPassword is a rare field...

[woodcock]

The first command is utter nonsense but the 2nd command should already do exactly what you are asking. To make the first command "work" you should do this (but I wouldn't):

index=<> | rename _* AS INVISIBLE_* | table *

[danielbb]

I see, index=<indexname> | fieldsummary doesn't show the rare XXXPassword field, while index=<indexname> XXXPassword | fieldsummary does show this field.

[danielbb]

Not much luck with index=<indexname> | stats dc() as *