How to see all discovered fields

[sdev]

Hi
I have added a cisco syslog as a syslog type. I have field discovery on. It shows 59 fields.
When I select pick fields in the UI, available fields are only 20
How do I see all fields?

Thanks!

[paddygriffin]

I believe the min_freq entry in limits.conf controls this but haven't had a chance to test. Assuming it does, the entry would look something like
min_freq = 0.0001
* Minimum frequency of a field required for including in the /summary endpoint as a fraction (>=0 and <=1).
* Defaults is 0.01 (1%)

[paddygriffin]

Great clarification/ correction. Thanks!

[sideview]

This is related but quite different. To see the difference, search in "index=_internal". Open the FieldPicker, and set that "1" in the form field to "0". Sort by "%" ascending, and you'll see a bunch of fields with <1% frequency. You'll see that all these fields however, if you click the tiny chart icon, it says they "have no summary information". The value set in the Field Picker's form field concerns whether they show up in the Field Picker's list. The value in limits.conf concerns whether there's actual "top 10 values" summary data.

[sdev]

Thanks very much!! That worked

[sideview]

yea, it's a bit of a strange design and this confuses people a lot. Note that when you open the big field picker control, that it has a little textfield at the top, on the left side. This textfield has a "%" symbol above it, and it'll have the number "1" in it. This strange little box is actually filtering the displayed fields according to the fields representation across the events.

In other words, when it says "1", which is the default, it will only show you the fields that are present in at least 1% of the events. Change it to 0 and you'll see all 59 fields.

[sideview]

Although that would make sense, there's no param on the FieldPicker module to do so. You could write a little javascript to patch the module, but this is a pretty advanced thing to do.

[bmunson_splunk]

Is there a way to make this a default. Maybe in the advanced XML?