topic "New Search" function of Table view misses Index in Splunk Search

"New Search" function of Table view misses Index

testuser013 — Thu, 10 Apr 2025 13:18:06 GMT

Hello,

today I have found a bug(?) in the "New Search" function from the Table view.

What I do mean with the "New Search" function:

Run a search and select the table view (not raw or list). Then click on one of the shown values of a field, for example the value of a host field, and select "New Search".

Now a new search starts with the selected field+value, but instead of using the same index(es) from the view before, only a * will be used.

As we do not have defined any default indexes in our environment those searches won't return any results, because no index is included ín the search. Is there a possibility how I can reconfigure this, instead of a plain asterisk?

Best Regards.

Re: "New Search" function of Table view misses Index

livehybrid — Thu, 10 Apr 2025 13:52:12 GMT

Which version of Splunk are you running? For me when I click on a "New Search" in either table view or list view I get the same behaviour, which in my example did index=_internal (Which I had searched) and added the field I clicked.

Does it differ if you have a more complex query?

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: "New Search" function of Table view misses Index

testuser013 — Thu, 10 Apr 2025 14:17:14 GMT

Hi,

we do use Version 9.2.4.

The behaviour is independent of the search complexity. It also doesn't change if I search internal logs or through several indexes. The index(es) will always be replaced by an *

The behaviour is also the same within the list view, so it's not only table view related.

Re: "New Search" function of Table view misses Index

ITWhisperer — Thu, 10 Apr 2025 16:19:37 GMT

The same happens with 9.4.1 - perhaps it is a feature? But, tbh, it sounds like a bug. Raise a ticket and see what support say?