I am seeing the "ip_address" and "file_path" fields being correctly extracted, but am experiencing strange behavior when I try to filter them. If I specify ip_address="10.119.32.165" in the search, I get partial results from my search. However, when I specify ip_address::10.119.32.165 in the search, all events return.
I was able to find this similar question, but why does Splunk consider data from the "fields" argument of a HEC metadata when the documentation literally calls them fields? Also, I'm familiar with how a Splunk forwarder works and know that a deployment app uses '::' to specify metadata during indexing, but why can't I use = to search search metadata in the first place? https://answers.splunk.com/answers/562832/add-to-search-returns-no-results.html
Just looking to understand what is happening here better, as this will be very confusing for my users.
Did you ever figure this out? I'm seeing the same thing and am wondering what I'm missing, since the documentation seems misleading to me as well. Even using the web UI to search for the "fields" uses = and produces no results, but changing the search to :: works fine.