Howcome additional condition increases result count?

[shai]

my question is very simple. 

This returns nothing:

sourcetype=my_sourcetype

This returns X amount of events (same amount as index=my_index):

index=my_index AND sourcetype=my_sourcetype

Search is in: Verbose Mode
what am I missing?! 
howcome another filter returns more events?

[gcusello]

Hi @shai,

this means that your index isn't in the search default path for your role [Settings > Roles > your_role > Indexes].

Anyway, it's always a best practice to use the index filter in every search, trying to limit the indexes to only the ones where the log to search are stored: this approach redduces the time search.

Ciao.

Giuseppe

[shai]

Hi @gcusello 
Thank you for your response

However it does not explain the odd behaviour because I use admin Role and in the setting page that you have referred me to, all the indices are included. So can you explain what else I might be missing?

Note that I witnessed this issue not only with indexes but with sourcetype.
for example searching for field=value yielded zero results but searching field=value AND sourcetype=certail_type did return results... 

[gcusello]

Hi @shai,

which Mode are you using in your searches?

did you try to use Verbose Mode?

Ciao.

Giuseppe

[shai]

hi @gcusello 
as written in the original post the mode is Verbose.

[gcusello · Accepted solution]

Hi @shai ,

in the [Settings > Roles > Indexes] Tab, are your index flagged also in the Default column?

Ciao.

Giuseppe

[shai]

@gcusello 
marking as default solved the issue. thank you very much.

[gcusello]

Hi @shai,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉