https://community.splunk.com/t5/Getting-Data-In/Search-using-metadata-returns-different-results/m-p/346897#M63696 <P>In this case, you need to have the fields.conf on your search head (where you’re searching.) </P> <P>Additionally, there is an inherent difference between a search for field=a and field::a</P> <P>The later of these is relevant for indexed fields. Search through your job inspector to see how the jobs are parsed differently. </P> Sat, 23 Sep 2017 00:28:53 GMT esix_splunk 2017-09-23T00:28:53Z https://community.splunk.com/t5/Getting-Data-In/Search-using-metadata-returns-different-results/m-p/346896#M63695 <P>I'm getting different search results for the metadata I added to my log events. What did I misconfigure?</P> <P>Added to inputs.conf on forwarder: _meta = datacenter::aws<BR /> Added to fields.conf on forwarder: [datacenter] INDEXED=true</P> <P>Returns very few results:<BR /> datacenter=aws</P> <P>Returns all results:<BR /> datacenter::aws</P> Fri, 22 Sep 2017 23:09:09 GMT https://community.splunk.com/t5/Getting-Data-In/Search-using-metadata-returns-different-results/m-p/346896#M63695 wzchin 2017-09-22T23:09:09Z https://community.splunk.com/t5/Getting-Data-In/Search-using-metadata-returns-different-results/m-p/346897#M63696 <P>In this case, you need to have the fields.conf on your search head (where you’re searching.) </P> <P>Additionally, there is an inherent difference between a search for field=a and field::a</P> <P>The later of these is relevant for indexed fields. Search through your job inspector to see how the jobs are parsed differently. </P> Sat, 23 Sep 2017 00:28:53 GMT https://community.splunk.com/t5/Getting-Data-In/Search-using-metadata-returns-different-results/m-p/346897#M63696 esix_splunk 2017-09-23T00:28:53Z