Splunk searches does not return expected values even though the data is completed

[josephp]

Hi, 

We recently migrated from a standalone Search Head to a clustered one. However, we are having some issue running some search commands. For example, this is a query that is not working on the new SH cluster

sourcetype=dataA index=deptA | where critC > 25

On the old search head, this query runs fine and we see the results as expected. But on the SH cluster, this doesn't yield anything. 

I have run the "sourcetype=dataA index=deptA" search query by itself, and they both see the same events. I am not sure why the search with (| where citC > 25) on the standalone SH would work and the cluster would not. Any help would be appreciated.

Thank you

[gcusello]

Hi @josephp ,

did you defined on the Search Head the field extraction for critC field?

if yes, the grants for this field are App or Global?

if App, are you in the same App?

Ciao.

Giuseppe

[josephp]

Hi Giuseppe,

May I have a pointer to splunk document for this "if yes, the grants for this field are App or Global?"?

Thank you,

[gcusello]

Hi @josephp ,

the point is that if you share the field extraction at App level, outside this app you cannot see the field.

So repeat your search in the App where you extracted the field and see if you have results.

If you need to run the search outside the app where the extraction is defined, share the field extraction at Global level.

Ciao.

Giuseppe