HI Friends,
In Search&Reporting app (default app) when I search anything, I see only 3 INTERESTING FIELDS coming up and when I search same thing from other apps (custom apps) on same Search Head I am able to see 100+ FIELDS. I am seeing this issue from only last one week, not sure what caused this issue.
How can I get these fields back and fix it, can you please suggest ?
The splunk settings that are causing the fields to exist are probably owned by those other apps but the permissions
are set to App
. You need to edit the permissions and change them to Global
(AKA All Apps
) so that it will take effect in any app.