Fluentbit logs sent through HEC and I am not able to search the field values except by adding "::"

[godman]

When i see the fields in the left hand side with 'X' no of event's and when i select any value it's not giving me the event's , if i add this in the search I am able to get it.

index= fluentbit KUBERNETES_NAMESPACE = "XXXX" --- Doesn't work
index= fluentbit KUBERNETES_NAMESPACE = XXXX --- Doesn't work
index= fluentbit KUBERNETES_NAMESPACE :: "XXXX" -- work's

I have added the fields in the fields.conf but nothing seems to work ?

[woodcock]

The answer from @mhoogcarspel_splunk is correct. If it isn't working, try also adding:

INDEXED_VALUE = true

If that doesn't work, then open a support case with splunk.

[mhoogcarspel_sp]

if KUBERNETES_NAMESPACE::XXXX works then add
fields.conf
[KUBERNETES_NAMESPACE]
INDEXED=true

to your search head

[godman]

I have added this in my SH's but I am seeing the same pattern where event's are not returning any values.

[vasanthmss]

Standalone / Distributed env.? Spunk version..?
Check
https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/Configureindex-timefieldextraction

[godman]

This is a Distributed Environment , and the splunk version is : 7.1.2