All Apps and Add-ons

Search using field value yields no results

cdo_splunk
Splunk Employee
Splunk Employee

I ran the search that returned no results.

index=_internal source="metrics.log" splunk_server="" group= "per_index_thruput" | eval MB=kb/1024 | chart sum(MB) by series | sort - sum(MB)

I can see there is raw data, but as soon as I added group=per_index_thruput, no results found. Somehow, it does not recognize the field “group” despite the field shows up in the left menu. I can workaround it by surrounding it with double quotes "group=per_index_thruput"  which forces splunk to search on the entire string — or just use per_index_thruput.

splunkIT
Splunk Employee
Splunk Employee

I had a similar issue too, and it turned out that there was a fields.conf file in one of my custom apps which has the following entries:

[default]
INDEXED = true

I believe the the default should be indexed=false. Anyway, once I have deleted this un-needed fields.conf file, and restarted splunk, my fields resumed working again.

sowings
Splunk Employee
Splunk Employee

Which app? That should be addressed.

0 Karma

splunkIT
Splunk Employee
Splunk Employee

my custom app

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...