Splunk Search

How can we show all fields, including rare ones?

danielbb
Motivator

I'm running -

index=<indexname> | fields

or

index=<indexname> | fieldsummary

They don't show the fields which are very rare in the content. Is there a way to see all fields even if they exist in a very small percentage of the events?

Tags (2)
0 Karma

woodcock
Esteemed Legend

You need to run your search in Verbose mode.

danielbb
Motivator

No luck @woodcock - running in Verbose mode for the past 24 hours index=<indexname>| fieldsummary didn't show the field whereas index=<indexname> XXXPassword | fieldsummary shows it.

And as we said, XXXPassword is a rare field...

0 Karma

woodcock
Esteemed Legend

The first command is utter nonsense but the 2nd command should already do exactly what you are asking. To make the first command "work" you should do this (but I wouldn't):

index=<> | rename _* AS INVISIBLE_* | table *

danielbb
Motivator

I see, index=<indexname> | fieldsummary doesn't show the rare XXXPassword field, while index=<indexname> XXXPassword | fieldsummary does show this field.

0 Karma

danielbb
Motivator

Not much luck with index=<indexname> | stats dc() as *

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...