topic Why does my sourcetype= search return no results, but pairing with index= does? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Why-does-my-sourcetype-search-return-no-results-but-pairing-with/m-p/163399#M33135 <P>I re-did some of my data inputs using the same indexes as before to add actual sourcetypes this time. I'm using HWF instead of UF to send data to my indexer. I can now search "index=my_index sourcetype=my_sourcetype", but when my search is just "sourcetype=my_sourcetype", it returns no results over the same time period. Is there a way to fix that? It happened with a couple of sourcetypes, but not all of them.</P> Mon, 28 Sep 2020 17:52:40 GMT craigkleen 2020-09-28T17:52:40Z Why does my sourcetype= search return no results, but pairing with index= does? https://community.splunk.com/t5/Getting-Data-In/Why-does-my-sourcetype-search-return-no-results-but-pairing-with/m-p/163399#M33135 <P>I re-did some of my data inputs using the same indexes as before to add actual sourcetypes this time. I'm using HWF instead of UF to send data to my indexer. I can now search "index=my_index sourcetype=my_sourcetype", but when my search is just "sourcetype=my_sourcetype", it returns no results over the same time period. Is there a way to fix that? It happened with a couple of sourcetypes, but not all of them.</P> Mon, 28 Sep 2020 17:52:40 GMT https://community.splunk.com/t5/Getting-Data-In/Why-does-my-sourcetype-search-return-no-results-but-pairing-with/m-p/163399#M33135 craigkleen 2020-09-28T17:52:40Z Re: Why does my sourcetype= search return no results, but pairing with index= does? https://community.splunk.com/t5/Getting-Data-In/Why-does-my-sourcetype-search-return-no-results-but-pairing-with/m-p/163400#M33136 <P>If I had to guess, the sourcetypes that return results are not returning results from my_index, but rather from other indexes? (check out the interesting fields)</P> Tue, 14 Oct 2014 16:58:23 GMT https://community.splunk.com/t5/Getting-Data-In/Why-does-my-sourcetype-search-return-no-results-but-pairing-with/m-p/163400#M33136 acharlieh 2014-10-14T16:58:23Z Re: Why does my sourcetype= search return no results, but pairing with index= does? https://community.splunk.com/t5/Getting-Data-In/Why-does-my-sourcetype-search-return-no-results-but-pairing-with/m-p/163401#M33137 <P>This may be a security related issue as "Indexes searched by default" will cause the user to only search which he/she is provisioned for. </P> <P>Check the role that is assigned to the user. Verify that my_index is in that list. </P> <P>(edit weird post bug)</P> Tue, 14 Oct 2014 17:09:35 GMT https://community.splunk.com/t5/Getting-Data-In/Why-does-my-sourcetype-search-return-no-results-but-pairing-with/m-p/163401#M33137 MartinMcNutt 2014-10-14T17:09:35Z Re: Why does my sourcetype= search return no results, but pairing with index= does? https://community.splunk.com/t5/Getting-Data-In/Why-does-my-sourcetype-search-return-no-results-but-pairing-with/m-p/163402#M33138 <P>Yeah, that's it. Thanks!</P> Tue, 14 Oct 2014 17:41:15 GMT https://community.splunk.com/t5/Getting-Data-In/Why-does-my-sourcetype-search-return-no-results-but-pairing-with/m-p/163402#M33138 craigkleen 2014-10-14T17:41:15Z