https://community.splunk.com/t5/Splunk-Search/Why-can-t-I-search-for-my-extracted-field/m-p/51644#M12521 <P>Hi, </P> <P>or just use the therm <STRONG>store::bar</STRONG></P> <P>greez christian</P> Thu, 16 Sep 2010 20:29:29 GMT Christian 2010-09-16T20:29:29Z https://community.splunk.com/t5/Splunk-Search/Why-can-t-I-search-for-my-extracted-field/m-p/51642#M12519 <P>I have a <CODE>store</CODE> field brought in by a scripted lookup. it shows up when i do a search for <CODE>sourcetype=foo</CODE>, I can even stats count by <CODE>store</CODE>. but I can't search <CODE>store=bar</CODE> on the search bar... ?!</P> <P>I thought that that this only happened for extracted fields where the value is not in the actual event</P> Thu, 16 Sep 2010 05:07:39 GMT https://community.splunk.com/t5/Splunk-Search/Why-can-t-I-search-for-my-extracted-field/m-p/51642#M12519 mctester 2010-09-16T05:07:39Z https://community.splunk.com/t5/Splunk-Search/Why-can-t-I-search-for-my-extracted-field/m-p/51643#M12520 <P>By default, Splunk will expand <CODE>store=bar</CODE> into <CODE>(bar AND store=bar)</CODE>. If <CODE>bar</CODE> doesn't exist in your event, the event will not be returned.</P> <P>If this is because store is an extracted field or lookup-based field, tell Splunk to not search for the text in the event by editing fields.conf:</P> <PRE><CODE>[store] INDEXED_VALUE = false </CODE></PRE> Thu, 16 Sep 2010 05:11:25 GMT https://community.splunk.com/t5/Splunk-Search/Why-can-t-I-search-for-my-extracted-field/m-p/51643#M12520 Jason 2010-09-16T05:11:25Z https://community.splunk.com/t5/Splunk-Search/Why-can-t-I-search-for-my-extracted-field/m-p/51644#M12521 <P>Hi, </P> <P>or just use the therm <STRONG>store::bar</STRONG></P> <P>greez christian</P> Thu, 16 Sep 2010 20:29:29 GMT https://community.splunk.com/t5/Splunk-Search/Why-can-t-I-search-for-my-extracted-field/m-p/51644#M12521 Christian 2010-09-16T20:29:29Z