I've got a problem and part of that problem is I'm not sure how to search for the solution.
Using Verbose search mode (others are the same though).
If I search
index="*" User_Priority="High" I get no results returned.
But If I search
index="*" User_Priority="High" OR User_Priority="Medium" | stats count by User_Priority I get results for the High Priority in the same time frame I searched above.
This is the same if I specify the index this data is in.
I don't understand this, and am looking on how I can get it fixed.
A very confused Splunker.
You are probably using
search mode (far right side between the histogram and the search results) setting of
Fast. Switch to
Verbose and both should work.