Sourcetypes not searchable

[benjamin009]

Hello Splunk world,

I am having a weird issue where I am seeing SourceTypes that are not searchable.

If i click into Search and Reporting and select the Data Summary, under the SourceTypes tab I see 61 SourceTypes.

However,

If i run a search that is something like " | metadata type=sourcetypes index=* " I get 147 SourceTypes listed.

One of those "hidden" SourceTypes is the data I need to search against.

Anyone have any ideas why/how this is happening?

[woodcock]

You are probably relying on Indexes searched by default which is a VERY bad habit. Try this:

index=* OR index=_* sourcetype=MyHiddenSourceType

Then, when you figure out what index has your sourcetype, you can do this:

index=IndexForMyHiddenSourctype sourcetype=MyHiddenSourceType

[benjamin009]

Thank you for the feedback. I'd though about that and we are using the query "Index=* sourcetype=HiddenSourceType" still no luck.

I see that sourcetype available in "|metadata" with current epoch time, but I get no results running over any timeframe. I know the data is there, it's just not letting me search through it.