search index="name" shows 0 results, but index="name" does

[mcarlson]

Hey Answers,

I created a new index called bacula.

When I search for:
"search index=bacula"

0 results show up. However, when I search for:
"index=bacula"

I get the data as expected.

The reason this matters is when I add my query to a dashboard, the dashboard automatically changes the query from "sourcetype=bacula..." to "search sourcetype=bacula..." and nothing shows up.

This is all within a app I created, and the index is associated with that app. I also modified the Roles (user and admin so far) to include the bacula index. Is there some addtional permission issues I have missed?

Thanks!

Mike

[hexx]

Where do you see the dashboard changing the query? Could you show us what lines appear in $SPLUNK_HOME/var/log/splunk/searches.log when you load the dashboard?

[mcarlson]

Right, and I am not including the word "search", Splunk is injecting "search" into the query when I add a saved search to a dashboard.

[atreece]

Entering anything in the search field uses the search command. Executing a search with "search" in it (except when required for a subsearch) is asking splunk to look in that index for the word "search" in the data. If any of your events have the word "search" in them somewhere, they would show up in this case.

[dwaddle]

search is the search command to search, and should be implied but not included as part of the search. (For example, in subsearches you need to specify search as the command.) This behavior may be a bug. If you have enterprise support, I would suggest a support case.