Splunk Search

Search results not displayed when using certain fields in the initial search string

Blu3fish
Path Finder

This is probably pretty straightforward but on my search head the following will not return any results:

index=train sourcetype=transcript slotID=1234

whereas the following will:

index=train sourcetype=transcript | search slotID=1234

slotID is a unique field extracted via props/transforms. Permissions are defined as read:everyone, write:admin What am I doing wrong?

Note that for other searches, I can query a unique field and it results will be returned: index=train sourcetype=transcript status=running (here "status" is extracted via the same props/transforms mechanism)

Tags (2)
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

This typically happens for two reasons.

  1. The value of slotID, here "1234", is not searchable on its own. We optimize searches by replacing the equality with the value, and post-filter. If this is the case, you can mark "slotID" as "INDEXED_VALUE = false" in fields.conf.
  2. If the slotID extraction is configured via an eventtype in props.conf, it will be extracted, but not searchable in the first search clause. There is no workaround for this.

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

This typically happens for two reasons.

  1. The value of slotID, here "1234", is not searchable on its own. We optimize searches by replacing the equality with the value, and post-filter. If this is the case, you can mark "slotID" as "INDEXED_VALUE = false" in fields.conf.
  2. If the slotID extraction is configured via an eventtype in props.conf, it will be extracted, but not searchable in the first search clause. There is no workaround for this.
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...