This is related to http://answers.splunk.com/answers/136754/splunk-sdk-fields.html.
I've tried searching via the SDK and also direct to REST endpoints, but my results only return the default indexed fields. For instance:
curl -sku admin:changeme https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search="search index=_internal | head"
returns these fields:
But the same search
index=_internal | head in the Splunk Web UI returns many more extracted fields.
It does not seem to matter if I use an export, oneshot, or "normal" search. Setting the namespace specifically does not seem to matter either.
Any insight appreciated.
What if you reference one of the fields you're expecting? Such as
search index=_internal log_level=* | head. I know that saved searches have a behaviour where they will only run extractions on fields that are used in the search.
We have this same issue. Our product uses the Java SDK to execute a saved search. If we don't mention the name of the field in the search, then we get no data for that field despite it showing up in the Splunk UI. We tried doing things like "| field " at the end but that causes the performance to fall off a cliff. The only solution seems to be to put "field1= field2=*" etc at the end of the query, which of course means our customers MUST modify the saved searches they want to use with our product. This is a bit unfriendly.
Returned to this issue today with a couple ideas, and one of them seems to work. By adding |fields * to the search expression, my SDK searches are now returning full verbose field extractions. Kinda un-intuitive. Gonna play with it some more but looks promising. I guess the idea is to specify the fields you want in the output using the |fields command.
We tried that. Check the performance of your searches. If there's a lot of fields, it will be geometrically WORSE. At least it was in our case.