Splunk Search

How can we show all fields, including rare ones?

danielbb
Motivator

I'm running -

index=<indexname> | fields

or

index=<indexname> | fieldsummary

They don't show the fields which are very rare in the content. Is there a way to see all fields even if they exist in a very small percentage of the events?

Tags (2)
0 Karma

woodcock
Esteemed Legend

You need to run your search in Verbose mode.

danielbb
Motivator

No luck @woodcock - running in Verbose mode for the past 24 hours index=<indexname>| fieldsummary didn't show the field whereas index=<indexname> XXXPassword | fieldsummary shows it.

And as we said, XXXPassword is a rare field...

0 Karma

woodcock
Esteemed Legend

The first command is utter nonsense but the 2nd command should already do exactly what you are asking. To make the first command "work" you should do this (but I wouldn't):

index=<> | rename _* AS INVISIBLE_* | table *

danielbb
Motivator

I see, index=<indexname> | fieldsummary doesn't show the rare XXXPassword field, while index=<indexname> XXXPassword | fieldsummary does show this field.

0 Karma

danielbb
Motivator

Not much luck with index=<indexname> | stats dc() as *

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...