Splunk Search

INTERESTING FIELDS missing in Search&Reporting app (default app)

pkumar9610
Explorer

HI Friends,

In Search&Reporting app (default app) when I search anything, I see only 3 INTERESTING FIELDS coming up and when I search same thing from other apps (custom apps) on same Search Head I am able to see 100+ FIELDS. I am seeing this issue from only last one week, not sure what caused this issue.

How can I get these fields back and fix it, can you please suggest ?

Tags (1)
0 Karma

woodcock
Esteemed Legend

The splunk settings that are causing the fields to exist are probably owned by those other apps but the permissions are set to App. You need to edit the permissions and change them to Global (AKA All Apps) so that it will take effect in any app.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...