Field search not working?

[acontarciego]

Hello,

I have records that look like this:
2012-09-24T18:31:38: ^^ AAA ^^ BBB ^^ CCC ^^^ DDD ^^^ EEE

The records get parsed correctly and values are assigned to field names at index time - i.e fld1=AAA, fld2=BBB, etc.

However, when you use these field/value pairs in a search, no events are returned.

E.g. The search, index=xxx fld1=AAA, results in 0 events found.

Any ideas on what's going on here?

Thanks!

[Ayn]

You should not use index-time extractions unless you have a very good reason for doing so and really know what you're doing. Index-time extractions affect performance negatively. You should always use search-time extractions unless there's a specific reason for not doing so.

This blog post covers the problem you might be running into: http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/