Splunk Search

Splunk is not searching results

sasankganta
Path Finder

Index=A sourcetype=B and I can see under fields category filed "C" with count of 10k+ values ..

But if I search with  Index=A sourcetype=B category=C , It is showing No results found tried in all the search modes didn't worked. source tcp:9997 . Can some one please suggest what can be the issue. 

Labels (1)
Tags (1)
0 Karma

sasankganta
Path Finder

field:: * worked , Thank You so much 

 

0 Karma

scelikok
Champion

@sasankganta,

Great! So, if you set this field as INDEXED on your search head, you will not need to use :: syntax. You can use below sample, than you will be able to search field=*

fields.conf

[field]
INDEXED=true

 

If this reply helps you an upvote is appreciated.

scelikok
Champion

Hi @sasankganta,

Is it possible that your category field is being sent to Splunk as a _meta? Please try searching like below;

I assume your field is C;

index=A sourcetype=B C::*

 

If this reply helps you an upvote is appreciated.

sasankganta
Path Finder

Yes, after using the same search like with "*field*" , still events are missing.

Under filed value count it's showing 4lack+ events , but in search filed value is showing 8 events. 

0 Karma

scelikok
Champion

Hi @sasankganta,

If I got it right, on your first search you see category values under C field? If so, you should use below search to filter categories;

index=A sourcetype=B C=*

If I missed something, please give a sample logs, result in screen capture.

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote is appreciated.
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!