When I search using the Python SDK, I don't seem to see any fields, other than the very basic ones like host, source, sourcetype... in the results. Is there a way to get the search to return all the same pre-extracted fields I get when using the splunk search GUI ? like fields automatically extracted by Splunk, such as those that come in field1=value1 ...etc?
Thanks,
Mohamed.
Hi @mlrhazi,
Splunk REST API does not extract fields like GUI. You should specify the required fields by rf (or required_fields on older versions) parameter. Please see the below documentation.
https://docs.splunk.com/Documentation/Splunk/9.0.3/RESTTUT/RESTsearches#Tips_on_creating_searches