topic Re: Field shows up under interesting fields but when you click any of the values, there are no results in Splunk Search

Field shows up under interesting fields but when you click any of the values, there are no results

jordanking1992 — Tue, 30 Jul 2019 16:48:58 GMT

We have data indexed in Splunk that has a field called pod. In the screenshots, you can see that pod has a list of values (and counts). However, when you select any of the values no results are returned. Someone mentioned that i should create an entry in fields.conf but i would like to know what Splunk is doing with this field. Any solutions are appreciated.

Re: Field shows up under interesting fields but when you click any of the values, there are no results

woodcock — Tue, 30 Jul 2019 17:01:06 GMT

You have to tell the Search Head that these fields are not indexed fields by adding this to fields.conf:

[pod]
INDEXED_VALUE = false

See details here:
https://www.splunk.com/blog/2011/10/07/cannot-search-based-on-an-extracted-field.html

Re: Field shows up under interesting fields but when you click any of the values, there are no results

jordanking1992 — Tue, 30 Jul 2019 17:25:12 GMT

So it interesting because this now lets me see the values but the count before clicking the value versus after clicking the value is WAY different. For instance, Splunk says the count is 286, 000 but when i click it it only shows 12 (for the exact same time range) ??

Re: Field shows up under interesting fields but when you click any of the values, there are no results

woodcock — Wed, 31 Jul 2019 05:06:31 GMT

Are you searching in verbose mode? If so, then I would open a support case.