Splunk Search

How can we show all fields, including rare ones?

danielbb
Motivator

I'm running -

index=<indexname> | fields

or

index=<indexname> | fieldsummary

They don't show the fields which are very rare in the content. Is there a way to see all fields even if they exist in a very small percentage of the events?

Tags (2)
0 Karma

woodcock
Esteemed Legend

You need to run your search in Verbose mode.

danielbb
Motivator

No luck @woodcock - running in Verbose mode for the past 24 hours index=<indexname>| fieldsummary didn't show the field whereas index=<indexname> XXXPassword | fieldsummary shows it.

And as we said, XXXPassword is a rare field...

0 Karma

woodcock
Esteemed Legend

The first command is utter nonsense but the 2nd command should already do exactly what you are asking. To make the first command "work" you should do this (but I wouldn't):

index=<> | rename _* AS INVISIBLE_* | table *

danielbb
Motivator

I see, index=<indexname> | fieldsummary doesn't show the rare XXXPassword field, while index=<indexname> XXXPassword | fieldsummary does show this field.

0 Karma

danielbb
Motivator

Not much luck with index=<indexname> | stats dc() as *

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...