Searching “index=_internal metrics | head 3” from Splunk Web returned the following events: 04-12-2018 18:39:43.514 +0200 INFO Metrics –…

By default, the Splunk REST API endpoint used to retrieve search results (/services/search/jobs/{searchid}/results) returns all fields that are extracted for each event. This includes the raw event data (raw), default metadata fields (such as sourcetype), and all fields extracted at search time. For the given metrics events, fields like name and instantaneouskbps are extracted from the key-value pairs within the raw data. Therefore, without any specific parameters to limit the field list in the API call, all listed fields will be included in the response for each event.

Not applicable, as all provided options are correct.

1. Splunk Enterprise REST API Reference Manual: In the documentation for the GET services/search/jobs/{searchid}/results endpoint

the description for the query parameter f (also known as fieldlist) explicitly states: "A comma-separated list of fields to return. If you do not specify a list of fields

all fields are returned." This confirms that the default behavior is to return every field associated with the search results. (See Splunk Enterprise 9.1.0 Documentation

Home > REST API Reference Manual > search/jobs/{searchid}/results).

2. Splunk Enterprise Search Manual: The manual describes how Splunk extracts fields at search time. For the internal logs

which often use a key-value pair format

Splunk automatically extracts these pairs as fields. The example event clearly shows fields like group

name

and instantaneouskbps which would be extracted and thus available in the API results. (See Splunk Enterprise 9.1.0 Documentation

Home > Search Manual > Get started with search > Use fields to search).