Christopher Brito

There isn't an easy way to iterate on fields when they are sucked into a timechart. The timechart fields become the value of the field rather than the original field...

Consider making use of `required_field_list` to pull fields out of _raw. Ref: http://splunk-base.splunk.com/answers/25867/fields-through-rest-api http://docs.splunk.com/Documentation/Splunk/4.2.1/Developer/RESTSearch