topic Re: transforms.conf fields are visible but returns zero rows when clicked/selected in Getting Data In

transforms.conf fields are visible but returns zero rows when clicked/selected

desi-indian — Mon, 28 Sep 2020 10:17:29 GMT

My props and transforms.conf work fine and I am able to see the fields on the GUI of search heads ( We are running splunk 4.2 in agent-->full forwarders-->Indexers-->search heads setup)..when I run a search they show field1 occured "x%" TIMES in the seach..But as soon as I click on the field It returns no rows ...When I use a wild card in the search It does return the data

Example

Index=abc will return dept_name="some_dept" exists in 10 % of the results and dept_name="finance" exists 2 % of time etc ..when I click the field dept_name="some_dept" and search becomes like
index=abc dept_name="some_dept" the search returns zero rows
when I do
index=abc dept_name=some* then I see all the data ...There are no other fields that get satisfied in some* regex except "some_dept"

Re: transforms.conf fields are visible but returns zero rows when clicked/selected

itinney — Mon, 09 Jan 2012 21:41:17 GMT

Is there a hidden character at the end of the values?

Given your example, what does search: index=abc dept_name="*some_dept*" return?

Re: transforms.conf fields are visible but returns zero rows when clicked/selected

desi-indian — Tue, 10 Jan 2012 20:27:30 GMT

I do not get any rows back when I do "some_dept" but that may not mean much as It will give onetime when I use dept_name=*dept but won't return any data doing exactly the same sometimes ..sorry I am not able to give much usefull info but this problem seems to not follow any pattren/logic

Re: transforms.conf fields are visible but returns zero rows when clicked/selected

desi-indian — Fri, 20 Jan 2012 16:28:50 GMT

I got this working by adding the specific trouble feilds to $splunk_home/etc/system/local/fields.conf file ...something like

[dept_name]

INDEXED_VALUE = false

Re: transforms.conf fields are visible but returns zero rows when clicked/selected

desi-indian — Fri, 20 Jan 2012 16:29:36 GMT

This fixed the issue