topic Re: After restoring a CSV based index, why are searches using fields or wildcards not returning results? in Splunk Search

After restoring a CSV based index, why are searches using fields or wildcards not returning results?

szaboszilard — Fri, 14 Aug 2015 08:06:48 GMT

I have a big big problem. I restored a csv based index. (MS Exchange mail track log)
The restored data is big, over 100GB.

When I'm starting a search specified by fields or "*data*" the search does not find anything. (The search process is very fast)
I'm exported some restored data, and I executed an grep command on it and found what I'm looking for.

Any idea, why I can't search in Splunk via fields or wildcard?

Regards

Re: After restoring a CSV based index, why are searches using fields or wildcards not returning results?

diogofgm — Fri, 14 Aug 2015 10:11:19 GMT

just to clarify, you can see the data in splunk looking only at the index, right? if so:

check if you are searching using smart or verbose mode while searching.
check if you have the props stanza for the sourcetype assigned to the events. (run this ./splunk btool props list --debug)

Re: After restoring a CSV based index, why are searches using fields or wildcards not returning results?

szaboszilard — Wed, 16 Sep 2015 13:35:43 GMT

There isn't any stanza problem, my search was running in verbose mode.
When i click to an event i can see the correct fields.
When i use a field in search, the process ends very fast without result.

Re: After restoring a CSV based index, why are searches using fields or wildcards not returning results?

szaboszilard — Wed, 16 Sep 2015 13:57:11 GMT

On left side at field list i can see the total unique fields count and the top 10 fields value.
I try to select one field value from field list, but the result is the same. No results, but is it in the index.

I can't understand why not works.

Re: After restoring a CSV based index, why are searches using fields or wildcards not returning results?

MuS — Mon, 21 Sep 2015 20:36:30 GMT

There isn't any stanza problem, my search was running in verbose mode. So switch back to verbose mode, I assume you're in fast mode now.

Read the docs http://docs.splunk.com/Documentation/Splunk/6.2.6/Search/Changethesearchmode to learn more about the search modes.

Re: After restoring a CSV based index, why are searches using fields or wildcards not returning results?

woodcock — Mon, 21 Sep 2015 21:20:07 GMT

You are probably running in to this well-known problem:

http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

The solution is to put this into fields.conf in the same directory that you have your field extractions (where props.conf is):

[MyField]
INDEXED_VALUE = false