Some questions about indexed rt (http://docs.splunk.com/Documentation/Splunk/6.2.2/Search/Aboutrealtimesearches#Indexed_real-time_search) apparently i can't post a link--so search for indexed realtime at splunk docs if you don't know what it is. the docs says setting indexed_realtime_use_by_default = true sets indexed rt to be the "default" behavior. if this is enabled, is there still a way I can run "normal", pre-indexer rt searches, perhaps with some search argument or command? is there a way to make indexed rt the default for a role, but allow other roles to use normal rt? are there any guidelines on best practices for setting indexed_realtime_default_span? thanks, bw ... View more

This is related to http://answers.splunk.com/answers/136754/splunk-sdk-fields.html. I've tried searching via the SDK and also direct to REST endpoints, but my results only return the default indexed fields. For instance: curl -sku admin:changeme https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search="search index=_internal | head" returns these fields: _bkt _cd _indextime _raw _serial _si _sourcetype _subsecond _time host index linecount source sourcetype splunk_server But the same search index=_internal | head in the Splunk Web UI returns many more extracted fields. It does not seem to matter if I use an export, oneshot, or "normal" search. Setting the namespace specifically does not seem to matter either. Any insight appreciated. ... View more