https://community.splunk.com/t5/Splunk-Search/Cannot-search-customized-field/m-p/30706#M6247 <P>You're not telling us how your field is extracted, but I strongly suspect that what you're see is what is described here: <A href="http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/">http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/</A></P> <P>Basically you're likely extracting a field value that isn't part of indexed data, or only part of a token in indexed data. For instance, in the first case, the field could have been extracted in something like this manner:</P> <PRE><CODE>[myfieldextraction] REGEX = (matchsomething) FORMAT = myfield::someothertext </CODE></PRE> <P>...so the field would have the value "someothertext" even though that value doesn't actually exist at all in the index.</P> <P>Or, in the second case, the extraction would look something like this:</P> <PRE><CODE>[myotherfieldextraction] REGEX = (matchjust)apartofaword FORMAT = myotherfield::$1 </CODE></PRE> <P>If any of these apply to your extraction, you are very likely seeing the effects that the blog post I linked to talks about.</P> Mon, 13 May 2013 06:12:29 GMT Ayn 2013-05-13T06:12:29Z https://community.splunk.com/t5/Splunk-Search/Cannot-search-customized-field/m-p/30705#M6246 <P>I can search by the following field key,</P> <PRE><CODE>test_field=* </CODE></PRE> <P>and Splunk Web displayed the lists.<BR /> Then I select the "test_field=testA"(so following keywords), but displayed no lists.</P> <PRE><CODE>test_field=* test_field=testA </CODE></PRE> <P>And the following search command display no result. </P> <PRE><CODE>test_field=testA </CODE></PRE> <P>Furthermore, I add "| search" between the two kewords, then displayed properly.</P> <PRE><CODE>test_field=* | search test_field=testA </CODE></PRE> <P>Why is this happened ?<BR /> Thank you for helping.</P> Mon, 13 May 2013 04:56:24 GMT https://community.splunk.com/t5/Splunk-Search/Cannot-search-customized-field/m-p/30705#M6246 sunrise 2013-05-13T04:56:24Z https://community.splunk.com/t5/Splunk-Search/Cannot-search-customized-field/m-p/30706#M6247 <P>You're not telling us how your field is extracted, but I strongly suspect that what you're see is what is described here: <A href="http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/">http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/</A></P> <P>Basically you're likely extracting a field value that isn't part of indexed data, or only part of a token in indexed data. For instance, in the first case, the field could have been extracted in something like this manner:</P> <PRE><CODE>[myfieldextraction] REGEX = (matchsomething) FORMAT = myfield::someothertext </CODE></PRE> <P>...so the field would have the value "someothertext" even though that value doesn't actually exist at all in the index.</P> <P>Or, in the second case, the extraction would look something like this:</P> <PRE><CODE>[myotherfieldextraction] REGEX = (matchjust)apartofaword FORMAT = myotherfield::$1 </CODE></PRE> <P>If any of these apply to your extraction, you are very likely seeing the effects that the blog post I linked to talks about.</P> Mon, 13 May 2013 06:12:29 GMT https://community.splunk.com/t5/Splunk-Search/Cannot-search-customized-field/m-p/30706#M6247 Ayn 2013-05-13T06:12:29Z https://community.splunk.com/t5/Splunk-Search/Cannot-search-customized-field/m-p/30707#M6248 <P>Thank you, Ayn.</P> Wed, 15 May 2013 02:44:47 GMT https://community.splunk.com/t5/Splunk-Search/Cannot-search-customized-field/m-p/30707#M6248 sunrise 2013-05-15T02:44:47Z