I have a Splunk app that parses some Snort files and assigns some fields to the content. The app works fine from the Splunk web page, but when I use the REST API (via Splunk for Java) I do not get my custom fields back unless they are in the search criteria. For instance, if I search for "src_ip_addr=*" then I will get the fields back in the results, otherwise I don't. I used to get them back regardless in Splunk 4.0. What do I need to change to get them to always come back for my sourcetype? Thanks for any help... -Brian ... View more