transforms.conf fields are visible but returns zero rows when clicked/selected

[desi-indian]

My props and transforms.conf work fine and I am able to see the fields on the GUI of search heads ( We are running splunk 4.2 in agent-->full forwarders-->Indexers-->search heads setup)..when I run a search they show field1 occured "x%" TIMES in the seach..But as soon as I click on the field It returns no rows ...When I use a wild card in the search It does return the data

Example

Index=abc will return dept_name="some_dept" exists in 10 % of the results and dept_name="finance" exists 2 % of time etc ..when I click the field dept_name="some_dept" and search becomes like
index=abc dept_name="some_dept" the search returns zero rows
when I do
index=abc dept_name=some* then I see all the data ...There are no other fields that get satisfied in some* regex except "some_dept"

[desi-indian · Accepted solution]

I got this working by adding the specific trouble feilds to $splunk_home/etc/system/local/fields.conf file ...something like

[dept_name]

INDEXED_VALUE = false

[desi-indian]

This fixed the issue

[desi-indian]

I do not get any rows back when I do "some_dept" but that may not mean much as It will give onetime when I use dept_name=*dept but won't return any data doing exactly the same sometimes ..sorry I am not able to give much usefull info but this problem seems to not follow any pattren/logic

[itinney]

Is there a hidden character at the end of the values?

Given your example, what does search: index=abc dept_name="*some_dept*" return?