How to get the details of a field value that does not appear in search results?

[moiezuddin]

How to get the details of field app=sencer, when it not shown in the values for the app field?

[markthompson]

Do you mean on your search results?

If so - On the left hand side is a panel that says "Fields", scroll to the bottom and it'll say "All Fields" Click that and it will bring up a list of all fields on that event. Select the tickbox and clicks save and it will show up.

If not - and you're trying to search for the field, as long as it exists, a simple

search ... | where app = "sencer"

Should do the trick

[moiezuddin]

im trying to search for the field

index=casm_prod sourcetype=smtrace | where app = "sencer"

Not result, but i can see anthor application listed in app values except "sencer"

[markthompson]

Also, be aware that you should use the table function inbetween, as it creates an output.

[markthompson]

As a shorter way, just include it in your original search index=casm_prod sourcetype=smtrace app=sencer

[markthompson]

try putting it in brackets WHERE (app="sencer")