topic Re: Why is search in index not displaying results that are present but displaying when searching for more data? in Splunk Search https://community.splunk.com/t5/Splunk-Search/Why-is-search-in-index-not-displaying-results-that-are-present/m-p/380523#M169715 <P>Both are being searched in Verbose mode. That was one of my thoughts but even in Fast or Smart this same thing happens. </P> Wed, 02 May 2018 20:47:30 GMT GenericSplunkUs 2018-05-02T20:47:30Z Why is search in index not displaying results that are present but displaying when searching for more data? https://community.splunk.com/t5/Splunk-Search/Why-is-search-in-index-not-displaying-results-that-are-present/m-p/380521#M169713 <P>I've got a problem and part of that problem is I'm not sure how to search for the solution. </P> <P>Using Verbose search mode (others are the same though).</P> <P>If I search <CODE>index="*" User_Priority="High"</CODE> I get no results returned. <BR /> But If I search <CODE>index="*" User_Priority="High" OR User_Priority="Medium" | stats count by User_Priority</CODE> I get results for the High Priority in the same time frame I searched above.</P> <P>This is the same if I specify the index this data is in. </P> <P>I don't understand this, and am looking on how I can get it fixed. </P> <P>A very confused Splunker.</P> Wed, 02 May 2018 19:38:52 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-search-in-index-not-displaying-results-that-are-present/m-p/380521#M169713 GenericSplunkUs 2018-05-02T19:38:52Z Re: Why is search in index not displaying results that are present but displaying when searching for more data? https://community.splunk.com/t5/Splunk-Search/Why-is-search-in-index-not-displaying-results-that-are-present/m-p/380522#M169714 <P>You are probably using <CODE>search mode</CODE> (far right side between the histogram and the search results) setting of <CODE>Fast</CODE>. Switch to <CODE>Smart</CODE> or <CODE>Verbose</CODE> and both should work.</P> Wed, 02 May 2018 20:40:35 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-search-in-index-not-displaying-results-that-are-present/m-p/380522#M169714 woodcock 2018-05-02T20:40:35Z Re: Why is search in index not displaying results that are present but displaying when searching for more data? https://community.splunk.com/t5/Splunk-Search/Why-is-search-in-index-not-displaying-results-that-are-present/m-p/380523#M169715 <P>Both are being searched in Verbose mode. That was one of my thoughts but even in Fast or Smart this same thing happens. </P> Wed, 02 May 2018 20:47:30 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-search-in-index-not-displaying-results-that-are-present/m-p/380523#M169715 GenericSplunkUs 2018-05-02T20:47:30Z Re: Why is search in index not displaying results that are present but displaying when searching for more data? https://community.splunk.com/t5/Splunk-Search/Why-is-search-in-index-not-displaying-results-that-are-present/m-p/380524#M169716 <P>I assume that <CODE>User_Priority</CODE> is an extracted field and you are experiencing this unfortunate situation:</P> <PRE><CODE><A href="https://www.splunk.com/blog/2011/10/07/cannot-search-based-on-an-extracted-field.html" target="test_blank">https://www.splunk.com/blog/2011/10/07/cannot-search-based-on-an-extracted-field.html</A> </CODE></PRE> Wed, 02 May 2018 21:03:51 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-search-in-index-not-displaying-results-that-are-present/m-p/380524#M169716 woodcock 2018-05-02T21:03:51Z Re: Why is search in index not displaying results that are present but displaying when searching for more data? https://community.splunk.com/t5/Splunk-Search/Why-is-search-in-index-not-displaying-results-that-are-present/m-p/380525#M169717 <P>This sounds like what I'm dealing with. I'll confirm then give you the 'accept' on your answer. Thanks!</P> Wed, 02 May 2018 21:08:24 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-search-in-index-not-displaying-results-that-are-present/m-p/380525#M169717 GenericSplunkUs 2018-05-02T21:08:24Z