topic Splunk searches does not return expected values even though the data is completed in Splunk Search

Splunk searches does not return expected values even though the data is completed

josephp — Tue, 21 Jan 2025 14:03:19 GMT

Hi,

We recently migrated from a standalone Search Head to a clustered one. However, we are having some issue running some search commands. For example, this is a query that is not working on the new SH cluster

sourcetype=dataA index=deptA | where critC > 25

On the old search head, this query runs fine and we see the results as expected. But on the SH cluster, this doesn't yield anything.

I have run the "sourcetype=dataA index=deptA" search query by itself, and they both see the same events. I am not sure why the search with (| where citC > 25) on the standalone SH would work and the cluster would not. Any help would be appreciated.

Thank you

Re: Splunk searches does not return expected values even though the data is completed

gcusello — Tue, 21 Jan 2025 14:06:39 GMT

Hi @josephp ,

did you defined on the Search Head the field extraction for critC field?

if yes, the grants for this field are App or Global?

if App, are you in the same App?

Ciao.

Giuseppe

Re: Splunk searches does not return expected values even though the data is completed

josephp — Tue, 21 Jan 2025 14:17:16 GMT

Hi Giuseppe,

May I have a pointer to splunk document for this "if yes, the grants for this field are App or Global?"?

Thank you,

Re: Splunk searches does not return expected values even though the data is completed

gcusello — Tue, 21 Jan 2025 15:40:41 GMT

Hi @josephp ,

the point is that if you share the field extraction at App level, outside this app you cannot see the field.

So repeat your search in the App where you extracted the field and see if you have results.

If you need to run the search outside the app where the extraction is defined, share the field extraction at Global level.

Ciao.

Giuseppe