index=environment sourcetype=infinity_thermostat < shows all the extracted fields and values under "Interesting Fields">
When I click and interesting field, see it's values and select a value (which adds it to the search), zero results are returned. Is this a bug in recent versions?
I've seen other "similar" posts and some talk about workarounds such as fields.conf, but this is pretty straight forward and the search time extractions are working, just not searchable when used in the search.
cooling=idle is the example I'm using which returns zero, cooling=idle* (zero results), cooling=idl* (zero results), cooling=id* (results), cooling=i* (results), cooling=* (all results), cooling=*idle (results)
This is a classic example of the field.conf problem so why are you doubting the appropriateness and efficacy? I will reiterate what you have already read:
If your values are not separated by major/minor-breakers (segmenters.conf), then they will not appear as indexed values in your tsidx so you have to tell the Search Head that these fields are not indexed fields by adding this to fields.conf: