https://community.splunk.com/t5/Splunk-Search/Search-results-not-displayed-when-using-certain-fields-in-the/m-p/55400#M13527 <P>This typically happens for two reasons.</P> <OL> <LI>The value of slotID, here "1234", is not searchable on its own. We optimize searches by replacing the equality with the value, and post-filter. If this is the case, you can mark "slotID" as "INDEXED_VALUE = false" in fields.conf.</LI> <LI>If the slotID extraction is configured via an eventtype in props.conf, it will be extracted, but not searchable in the first search clause. There is no workaround for this.</LI> </OL> Wed, 22 Sep 2010 05:36:29 GMT Stephen_Sorkin 2010-09-22T05:36:29Z https://community.splunk.com/t5/Splunk-Search/Search-results-not-displayed-when-using-certain-fields-in-the/m-p/55399#M13526 <P>This is probably pretty straightforward but on my search head the following will <STRONG>not</STRONG> return any results:</P> <PRE><CODE>index=train sourcetype=transcript slotID=1234 </CODE></PRE> <P>whereas the following will:</P> <PRE><CODE>index=train sourcetype=transcript | search slotID=1234 </CODE></PRE> <P>slotID is a unique field extracted via props/transforms. Permissions are defined as read:everyone, write:admin What am I doing wrong?</P> <P>Note that for other searches, I can query a unique field and it results will be returned: index=train sourcetype=transcript status=running (here "status" is extracted via the same props/transforms mechanism)</P> Wed, 22 Sep 2010 04:51:50 GMT https://community.splunk.com/t5/Splunk-Search/Search-results-not-displayed-when-using-certain-fields-in-the/m-p/55399#M13526 Blu3fish 2010-09-22T04:51:50Z https://community.splunk.com/t5/Splunk-Search/Search-results-not-displayed-when-using-certain-fields-in-the/m-p/55400#M13527 <P>This typically happens for two reasons.</P> <OL> <LI>The value of slotID, here "1234", is not searchable on its own. We optimize searches by replacing the equality with the value, and post-filter. If this is the case, you can mark "slotID" as "INDEXED_VALUE = false" in fields.conf.</LI> <LI>If the slotID extraction is configured via an eventtype in props.conf, it will be extracted, but not searchable in the first search clause. There is no workaround for this.</LI> </OL> Wed, 22 Sep 2010 05:36:29 GMT https://community.splunk.com/t5/Splunk-Search/Search-results-not-displayed-when-using-certain-fields-in-the/m-p/55400#M13527 Stephen_Sorkin 2010-09-22T05:36:29Z