Field shows up under interesting fields but when you click any of the values, there are no results

[jordanking1992]

We have data indexed in Splunk that has a field called pod. In the screenshots, you can see that pod has a list of values (and counts). However, when you select any of the values no results are returned. Someone mentioned that i should create an entry in fields.conf but i would like to know what Splunk is doing with this field. Any solutions are appreciated.

[woodcock]

You have to tell the Search Head that these fields are not indexed fields by adding this to fields.conf:

[pod]
INDEXED_VALUE = false

See details here:
https://www.splunk.com/blog/2011/10/07/cannot-search-based-on-an-extracted-field.html

[jordanking1992]

So it interesting because this now lets me see the values but the count before clicking the value versus after clicking the value is WAY different. For instance, Splunk says the count is 286, 000 but when i click it it only shows 12 (for the exact same time range) ??

[woodcock]

Are you searching in verbose mode? If so, then I would open a support case.