Cannot search customized field ...

[sunrise]

I can search by the following field key,

test_field=*

and Splunk Web displayed the lists.
Then I select the "test_field=testA"(so following keywords), but displayed no lists.

test_field=* test_field=testA

And the following search command display no result.

test_field=testA

Furthermore, I add "| search" between the two kewords, then displayed properly.

test_field=* | search test_field=testA

Why is this happened ?
Thank you for helping.

[Ayn · Accepted solution]

You're not telling us how your field is extracted, but I strongly suspect that what you're see is what is described here: http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

Basically you're likely extracting a field value that isn't part of indexed data, or only part of a token in indexed data. For instance, in the first case, the field could have been extracted in something like this manner:

[myfieldextraction]
REGEX = (matchsomething)
FORMAT = myfield::someothertext

...so the field would have the value "someothertext" even though that value doesn't actually exist at all in the index.

Or, in the second case, the extraction would look something like this:

[myotherfieldextraction]
REGEX = (matchjust)apartofaword
FORMAT = myotherfield::$1

If any of these apply to your extraction, you are very likely seeing the effects that the blog post I linked to talks about.

[sunrise]

Thank you, Ayn.