Splunk Search
Highlighted

Why am I missing all "Interesting Fields" in the Search & Reporting screen?

Engager

I'm missing ALL of the interesting fields.

I used to see such things as datehour, dateminute, etc, etc. If I manually add those to the search, they show up in "Interesting Fields".
Same with my custom fields in splunk/etc/apps/search/local/props.conf. If I add them to the search, they'll show up under "Interesting Fields".

If I go to "Extract New Fields", and click on a line, they show up as already defined.

Highlighted

Re: Why am I missing all "Interesting Fields" in the Search & Reporting screen?

Legend

Interesting fields only show up if there more that 20% of the events with that field. Having said that, what mode is your search set to? Interesting fields will not show in Fast mode. Try changing it to Smart or Verbose

View solution in original post

Highlighted

Re: Why am I missing all "Interesting Fields" in the Search & Reporting screen?

Contributor

what a freaking life saver. i was on fast mode

0 Karma