Splunk Search

Why do I only get default indexed fields via REST or SDK call, but get more extracted fields in Splunk Web for the same search?

Splunk Employee
Splunk Employee

This is related to http://answers.splunk.com/answers/136754/splunk-sdk-fields.html.

I've tried searching via the SDK and also direct to REST endpoints, but my results only return the default indexed fields. For instance:

curl -sku admin:changeme https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search="search index=_internal | head"

returns these fields:


But the same search index=_internal | head in the Splunk Web UI returns many more extracted fields.

It does not seem to matter if I use an export, oneshot, or "normal" search. Setting the namespace specifically does not seem to matter either.

Any insight appreciated.

Splunk Employee
Splunk Employee

Returned to this issue today with a couple ideas, and one of them seems to work. By adding |fields * to the search expression, my SDK searches are now returning full verbose field extractions. Kinda un-intuitive. Gonna play with it some more but looks promising. I guess the idea is to specify the fields you want in the output using the |fields command.


0 Karma


We tried that. Check the performance of your searches. If there's a lot of fields, it will be geometrically WORSE. At least it was in our case.

0 Karma


What if you reference one of the fields you're expecting? Such as search index=_internal log_level=* | head. I know that saved searches have a behaviour where they will only run extractions on fields that are used in the search.

0 Karma


We have this same issue. Our product uses the Java SDK to execute a saved search. If we don't mention the name of the field in the search, then we get no data for that field despite it showing up in the Splunk UI. We tried doing things like "| field " at the end but that causes the performance to fall off a cliff. The only solution seems to be to put "field1= field2=*" etc at the end of the query, which of course means our customers MUST modify the saved searches they want to use with our product. This is a bit unfriendly.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>