Consider making use of `required_field_list` to pull fields out of _raw. Ref: http://splunk-base.splunk.com/answers/25867/fields-through-rest-api http://docs.splunk.com/Documentation/Splunk/4.2.1/Developer/RESTSearch