I have a splunk acct that i login to via vpn. The issue is that when i use the "search" area i cannot get an output but i when i use the "find" area for the same query, i get my output. Is there a way the change that? I just want to put my query in the "search" area to get my output.
Welcome to Splunk!
Please help us to help you. What do you mean by "search area" and "find area"? What text are you putting into each? What are you trying to get for output?
If you put "index=_internal" in the Find box then you should get a list of reports and dashboards that contain that string. The last entry should be "Open 'index=_internal' in Search. Clicking that should be the same as putting "index=_internal" in a search box.
Do you have access to the _internal index? Usually, only admins and (sometimes) power users have access. Not having access to the index would explain why you get no results from the Search box (no, Splunk won't say "you don't have access"). OTOH, if the Find box turns up a report that runs as Owner and the owner has access then you will see results.
If you are an admin then you should have access to _internal. Try searching index=_internal earliest=-1h. If you get results then you have access.
Another way is to go to Settings->Users and look at your account.
In addition to looking at your capabilities, look at the indexes you are allowed to access. Do that by going to Settings->Roles and clicking on your role. Then select the Indexes tab. There should be a mark in the _internal box.