Splunk Search

Indexed field is not showing up when I use "=" in the search.

paras
Explorer

We use cribl for field extraction. `Action` is a field that is being parsed from cribl and it should be a indexed field in splunk.


Did a initial search with the query "index=client* sourcetype=unix_auth" 
Screen Shot 2021-08-12 at 9.17.24 AM.png

This returns 6 failure in the last 4 hours. 

When I use the search "index=client* sourcetype=unix_auth action=fail*". It returns all 6 failed events. 

Screen Shot 2021-08-12 at 9.17.48 AM.png

when I then change the search to "index=client* sourcetype=unix_auth action=failure" It does not return any events. 

Screen Shot 2021-08-12 at 9.18.06 AM.png

But when I use the " :: " in the search "index=client* sourcetype=unix_auth action::failure" It returns all the events. 

Screen Shot 2021-08-12 at 9.18.17 AM.png

Sample event:

 

Screen Shot 2021-08-12 at 9.24.37 AM.png

Labels (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @paras,

You should add your extracted indexed fields into fields.conf on your search heads. Otherwise you can only search using :: notation. Please try below;

fields.conf

[action]
INDEXED=true
If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...