Why is one interesting field not always displayed, and what change do we need to make to have this field always appear by default?

[sivapuvvada]

I am not always getting one interesting field, even though I have selected all fields from the fields bar on the left side.

How does Splunk extract interesting fields by default? Where do we need to make a change if we want to always see this interesting field by default?

[woodcock]

The splunk settings that are causing the fields to exist are probably owned by those other apps but the permissions are set to App. You need to edit the permissions and change them to Global (AKA All Apps) so that it will take effect in any app.

[woodcock]

You cannot make a field more interesting without making it more common (frequently occurring in your events). You can however make it a Selected field and then it will always appear. Do it like this:

Perform a search where the field exists for at least 1 search.
Click on All Fields in the upper right of the Fields area (left side of screen under timeline).
Type your field name into the Filter box in the Field Picker dialog that opens.
Mark/Select the checkbox next to your Field Name.
Dismiss the Field Picker dialog.

Now your field will show in the Selected Fields list and also underneath each event (as long as you are in List or Table mode).

[pkumar9610]

@woodcock : When I click on All fields I see only 6 Fields on Search Head, what do I need to do to get all the fields back ?

I have raised issue in: https://answers.splunk.com/answers/763583/interesting-fields-missing-in-searchreporting-app.html?min...

[kbarker302]

What mode are you searching in? (See the dropdown list on the right under the search icon.) Interesting fields do not show up in Fast Mode - they only show up in Smart or Verbose Mode. I'm not sure if there's a way to make them show up by default.