Extra indexed field in _meta require * in search query

[jeanmatthieu]

Hi,

I have an inputs.conf as below in my UniversalForwarder

[monitor::///private/var/log/system.log]
_meta = serial_number::"ABC123456"
disabled = False
index = core
sourcetype = osx_syslog

Events are pushed nicely and search works well except for one minor issue.
To search by serial numbers, I have to do

index=core serial_number::ABC123456

or

index=core serial_number=*ABC123456*

However I wish to be able to search as such

index=core serial_number=ABC123456

I would be grateful if you could help me figure out what additional configuration stanzas might be needed and hopefully this can be set on the SplunkForwarder end.

Thank you for your help!
Jean-Matthieu

[the_wolverine]

[serial_number]
INDEXED_VALUE=false

[jeanmatthieu]

Adding stanzas in fields.conf on the indexer help sorting this out

[serial_number]
INDEXED=true

or

[default] 
# Apply to all extra _meta indexed field
INDEXED=true

Will there be an impact on search time extracted fields performance to add the default stanza as defined above ?

Thanks!

[ashishmusale]

I tried adding INDEXED=true but that did not work. Any other suggestions?

[woodcock]

He meant INDEXED=false