Search results not displayed when using certain fields in the initial search string

[Blu3fish]

This is probably pretty straightforward but on my search head the following will not return any results:

index=train sourcetype=transcript slotID=1234

whereas the following will:

index=train sourcetype=transcript | search slotID=1234

slotID is a unique field extracted via props/transforms. Permissions are defined as read:everyone, write:admin What am I doing wrong?

Note that for other searches, I can query a unique field and it results will be returned: index=train sourcetype=transcript status=running (here "status" is extracted via the same props/transforms mechanism)

[Stephen_Sorkin · Accepted solution]

This typically happens for two reasons.

1. The value of slotID, here "1234", is not searchable on its own. We optimize searches by replacing the equality with the value, and post-filter. If this is the case, you can mark "slotID" as "INDEXED_VALUE = false" in fields.conf.
2. If the slotID extraction is configured via an eventtype in props.conf, it will be extracted, but not searchable in the first search clause. There is no workaround for this.