Splunk Search

INTERESTING FIELDS missing in Search&Reporting app (default app)

pkumar9610
Explorer

HI Friends,

In Search&Reporting app (default app) when I search anything, I see only 3 INTERESTING FIELDS coming up and when I search same thing from other apps (custom apps) on same Search Head I am able to see 100+ FIELDS. I am seeing this issue from only last one week, not sure what caused this issue.

How can I get these fields back and fix it, can you please suggest ?

Tags (1)
0 Karma

woodcock
Esteemed Legend

The splunk settings that are causing the fields to exist are probably owned by those other apps but the permissions are set to App. You need to edit the permissions and change them to Global (AKA All Apps) so that it will take effect in any app.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...