I added events through Splunk's REST API and i added new fields to the new events that i added to Splunk.
Then i search the added events and retrieved the new events added. When i retrieved the new events added from the search app, i realised that in the xml format there are no new xml tags for the new fields.
When i added the new events to splunk, i formatted the new field=value pairs in the log message, Splunk created new fields after i added them through the REST API. But however i retrieved those new eventsm as an xml, i saw the new field value pairs present within the "_raw" xml tags. Why is that so? How to ensure that there are new field tags are created whenever i retrieve the new fields during search?
