Why Interesting field Showing values count when i click its showing 0 events and if i use * then its work?

abhishekdubey00 — Thu, 10 Aug 2023 21:56:07 GMT

Interesting field Showing values count when I click its get automatically added search its showing 0 events and if i use * then its work if i search for particular string then its showing 0 events

index=abc

Index=abdc cluster_name="abc" (not working)
Index=abdc cluster_name="*" Showing Result

Re: Why Interesting field Showing values count when i click its showing 0 events and if i use * then its work?

isoutamo — Fri, 11 Aug 2023 10:00:49 GMT

when you are using cluster_name="*" are you getting the "abc" in a result set or not?

If yes then the normal situation is that your data and tokenisation for it has some "issue/challenge". There could be some ways to fix it with conf files based on what is actually reason for that.

When you are searching it by cluster_name = "*abc" or with another time cluster_name = "abc*" did those works?

You should also look the raw event how it's on index and how it's is tokenised.

r. Ismo

topic Why Interesting field Showing values count when i click its showing 0 events and if i use * then its work? in Splunk Enterprise

Why Interesting field Showing values count when i click its showing 0 events and if i use * then its work?

Re: Why Interesting field Showing values count when i click its showing 0 events and if i use * then its work?