topic Re: _meta not getting expected logs to splunk in Splunk Search

_meta not getting expected logs to splunk

rajpalyalla — Mon, 04 Feb 2019 21:57:23 GMT

Hello,

we have index "text-index"
and region is passed as meta
_meta = region::east
sourcetype = testlogs

when i query
index="text-index" sourcetype=testlogs

i see all the logs displayed.

when i use index="text-index" sourcetype=testlogs region="*" i see all the logs displayed

but when i use index="text-index" sourcetype=testlogs region="east" it will display the logs only which has word east. its supposed list all the like other two queries above. why does it gives me only if words match. please correct me if i'm doing anything wrong

Re: _meta not getting expected logs to splunk

martin_mueller — Mon, 04 Feb 2019 22:16:46 GMT

You'll need to declare the region field as indexed: https://answers.splunk.com/answers/723488/is-it-possible-to-treat-a-meta-field-as-a-non-inde.html

Re: _meta not getting expected logs to splunk

rajpalyalla — Tue, 05 Feb 2019 04:17:40 GMT

i have already set this in fileds.conf
[region]
INDEXED=true

Re: _meta not getting expected logs to splunk

rajpalyalla — Tue, 12 Feb 2019 15:08:38 GMT

any other suggestions please?