Data Model: Change Root Event Constraint returns 0 results.

[Tim_1]

Hi all,

I've been working on a Data Model, and have a root event with constraint:
index=test_index

Now, when I change the constraint to:
index=prod_index

In the preview, nothing gets returned.

1) Can you change the index in the constraint?
2) Also, can you have wildcard in the constrain such as index="*_index"?

There is data in both indexes and I'm using Splunk Enterprise 6.4.2.

Thanks all.

[andre_tucker]

Yes I believe if your constraints are required and come in as null then the preview will take this into account and not show results. Please test by changing the required field to optional. If that does not work let me know.

[andre_tucker]

Are there any fields that you are specifying as "required" that are null in your prod index?

[Tim_1]

@andre_tucker, yes there were.
Does previewing the data when changing the constraint also apply the required attributes as well then?