All Apps and Add-ons

Search using field value yields no results

cdo_splunk
Splunk Employee
Splunk Employee

I ran the search that returned no results.

index=_internal source="metrics.log" splunk_server="" group= "per_index_thruput" | eval MB=kb/1024 | chart sum(MB) by series | sort - sum(MB)

I can see there is raw data, but as soon as I added group=per_index_thruput, no results found. Somehow, it does not recognize the field “group” despite the field shows up in the left menu. I can workaround it by surrounding it with double quotes "group=per_index_thruput"  which forces splunk to search on the entire string — or just use per_index_thruput.

splunkIT
Splunk Employee
Splunk Employee

I had a similar issue too, and it turned out that there was a fields.conf file in one of my custom apps which has the following entries:

[default]
INDEXED = true

I believe the the default should be indexed=false. Anyway, once I have deleted this un-needed fields.conf file, and restarted splunk, my fields resumed working again.

sowings
Splunk Employee
Splunk Employee

Which app? That should be addressed.

0 Karma

splunkIT
Splunk Employee
Splunk Employee

my custom app

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!