I am getting the following when using the following search:
index=juniperfirewall tag=* |search tag=ids
The tag=* was put there as it was a way to get the search running per:
http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/
I could easily fix this by removing the eventtypes from where they are failing or adding eventtypes to the config file, however, this is an OOB app and we should not have to customize it to make it work.
In fact I have no idea why I am getting as the tags that seem to be unsearchable are "attack" and "ids"
{'debug': ['[myIndexer] search context: user="admin", app="search", bs-pathname="D:\\Program Files\\Splunk\\var\\run\\searchpeers\\MySearchHead-9999999999"', 'base lispy: [ AND index::juniperfirewall ]', 'search context: user="admin", app="search", bs-pathname="D:\\Program Files\\Splunk\\etc"'], 'warn': ["Eventtype 'gconfd_Linux_syslog' does not exist or is disabled.", "Eventtype 'gdm_Linux_general_syslog' does not exist or is disabled.", "Eventtype 'hpoid' does not exist or is disabled.", "Eventtype 'nix_agpart' does not exist or is disabled.", "Eventtype 'nix_configuration_change' does not exist or is disabled.", "Eventtype 'nix_kernel' does not exist or is disabled.", "Eventtype 'unix_runlevel_change' does not exist or is disabled."]}
