I have a search that seems to work in any mode (fast, smart, verbose) on 6.6.2, but only works in smart or verbose mode on 7.1.0. Perhaps my regex field extraction is no longer working properly?
The search looks sort of like this
index=testindex sourcetype=testsource host=* testfield=123
Another weird quirk is that when I run the search on 7.1.0 I get no results in fast mode, unless I add | table * , in which case I then get results.
I would like to know what changed around this so that I can figure out to what extent it could affect reports, alerts, and dashboards.
Edit: This does seem limited to a specific sourcetype, I can run a similar search in Fast Mode on another sourcetype and it works as it did before.
Edit2: This is not limited to a specific sourcetype. The reason it was working on the other sourcetype is that the search was able to do a raw text search for testfield=123 and find it. In my scenario a raw text search does not work.
