CLI search query not giving results. Working fine on searchhead GUI

[Reethika]

Hi,

/opt/splunk/bin/splunk search " index=****  sourcetype="*****:proxylogs" earliest=-15m@m latest=now | fields action,bytes,bytes_in,bytes_out,src,category,date_hour,date_mday,date_minute,date_month,date_second,date_wday,date_year,date_zone,url,site,domain,dest_ip,user,user_bunit,user_work_city,user_work_country,user_work_lat,user_work_long,_time | table action,bytes,bytes_in,bytes_out,src,category,date_hour,date_mday,date_minute,date_month,date_second,date_wday,date_year,date_zone,url,site,domain,dest_ip,user,user_bunit,user_work_city,user_work_country,user_work_lat,user_work_long,_time ')"

Result : INFO: No matching fields exist.
                INFO: Your timerange was substituted based on your search string

Above is the search for which no results are returned from CLI. 

From GUI(Searchhead) I get results. 

Could anyone please help. 

Thanks

[niketn]

Can you try the following:

./splunk search 'index=****  sourcetype="*****:proxylogs" earliest=-15m@m latest=now | fields index,sourcetype,action,bytes,bytes_in,bytes_out,src,category,date_hour,date_mday,date_minute,date_month,date_second,date_wday,date_year,date_zone,url,site,domain,dest_ip,user,user_bunit,user_work_city,user_work_country,user_work_lat,user_work_long,_time | table index,sourcetype,action,bytes,bytes_in,bytes_out,src,category,date_hour,date_mday,date_minute,date_month,date_second,date_wday,date_year,date_zone,url,site,domain,dest_ip,user,user_bunit,user_work_city,user_work_country,user_work_lat,user_work_long,_time'

 Also do you not get any result even if you increase the time window for the search?

I tried the following and it worked fine. (I had some data with csv sourcetype and did not have all the fields).

 ./splunk search 'index=****  sourcetype="*****_csv" earliest=-1mon latest=now | fields index,sourcetype,action,bytes,bytes_in,bytes_out,src,category,date_hour,date_mday,date_minute,date_month,date_second,date_wday,date_year,date_zone,url,site,domain,dest_ip,user,user_bunit,user_work_city,user_work_country,user_work_lat,user_work_long,_time | table index,sourcetype,action,bytes,bytes_in,bytes_out,src,category,date_hour,date_mday,date_minute,date_month,date_second,date_wday,date_year,date_zone,url,site,domain,dest_ip,user,user_bunit,user_work_city,user_work_country,user_work_lat,user_work_long,_time'