Splunk Search

How can we show all fields, including rare ones?

Motivator

I'm running -

index=<indexname> | fields

or

index=<indexname> | fieldsummary

They don't show the fields which are very rare in the content. Is there a way to see all fields even if they exist in a very small percentage of the events?

Tags (2)
0 Karma

Esteemed Legend

You need to run your search in Verbose mode.

Motivator

No luck @woodcock - running in Verbose mode for the past 24 hours index=<indexname>| fieldsummary didn't show the field whereas index=<indexname> XXXPassword | fieldsummary shows it.

And as we said, XXXPassword is a rare field...

0 Karma

Esteemed Legend

The first command is utter nonsense but the 2nd command should already do exactly what you are asking. To make the first command "work" you should do this (but I wouldn't):

index=<> | rename _* AS INVISIBLE_* | table *

Motivator

I see, index=<indexname> | fieldsummary doesn't show the rare XXXPassword field, while index=<indexname> XXXPassword | fieldsummary does show this field.

0 Karma

Motivator

Not much luck with index=<indexname> | stats dc() as *

0 Karma