topic Re: Sourcetypes not searchable in Getting Data In

Sourcetypes not searchable

benjamin009 — Wed, 07 Oct 2015 13:28:00 GMT

Hello Splunk world,

I am having a weird issue where I am seeing SourceTypes that are not searchable.

If i click into Search and Reporting and select the Data Summary, under the SourceTypes tab I see 61 SourceTypes.

However,

If i run a search that is something like " | metadata type=sourcetypes index=* " I get 147 SourceTypes listed.

One of those "hidden" SourceTypes is the data I need to search against.

Anyone have any ideas why/how this is happening?

Re: Sourcetypes not searchable

woodcock — Wed, 07 Oct 2015 13:34:40 GMT

You are probably relying on Indexes searched by default which is a VERY bad habit. Try this:

index=* OR index=_* sourcetype=MyHiddenSourceType

Then, when you figure out what index has your sourcetype, you can do this:

index=IndexForMyHiddenSourctype sourcetype=MyHiddenSourceType

Re: Sourcetypes not searchable

benjamin009 — Wed, 07 Oct 2015 13:47:49 GMT

Thank you for the feedback. I'd though about that and we are using the query "Index=* sourcetype=HiddenSourceType" still no luck.

I see that sourcetype available in "|metadata" with current epoch time, but I get no results running over any timeframe. I know the data is there, it's just not letting me search through it.