https://community.splunk.com/t5/Splunk-Search/Varying-search-results/m-p/188679#M187096 <P>Check the "Indexes searched by default" setting for your role. It probably does not include batchfs.</P> Wed, 20 Aug 2014 17:00:23 GMT richgalloway 2014-08-20T17:00:23Z https://community.splunk.com/t5/Splunk-Search/Varying-search-results/m-p/188678#M187095 <P>I get different search results when I search using Host and Index.</P> <P>When I search index=batchfs I get the following result:</P> <PRE><CODE>2014-08-20 11:16:00.012-04:00 INFO [Timer-0] "com.domain.util.log.PerfLog2.writeLog:418" Performance statistics for period 11:06 to 11:16 (10 minutes). Heap size in bytes is 657668584 LongRunningConnectionLogger:ProcessConnectionEventQ #:20 avg:0 sd:0 min:0 max:0 host = servername source = D:\path\path\dgw.log sourcetype = dgw </CODE></PRE> <P>When I search for index=batchfs host=servername I get the same result.</P> <P>However when I search for host=servername I get no results found.</P> <P>Why am I unable to search by host name?</P> Wed, 20 Aug 2014 15:54:51 GMT https://community.splunk.com/t5/Splunk-Search/Varying-search-results/m-p/188678#M187095 zbumpers 2014-08-20T15:54:51Z https://community.splunk.com/t5/Splunk-Search/Varying-search-results/m-p/188679#M187096 <P>Check the "Indexes searched by default" setting for your role. It probably does not include batchfs.</P> Wed, 20 Aug 2014 17:00:23 GMT https://community.splunk.com/t5/Splunk-Search/Varying-search-results/m-p/188679#M187096 richgalloway 2014-08-20T17:00:23Z