Unable to search particular summary index field following Splunk upgrade from 7.0.0 to 8.1.4

[briancronrath]

Encountering a very odd issue where I have a daily summary index that has pretty simple key=value pairings for fields, but I can no longer search on the fields specifically.  For instance an event might have a field included that reads cluster=cluster1A and if I search for cluster=cluster1A, I get no results, but if I search for just the text cluster1A, I get results.  What might I be able to look into here?

[codebuilder]

Try checking the job inspector logs after running the search that returns no results. It should provide some insight into what's happening.

[burwell]

Hi. Is it only this summary index that you cannot search?

Are you able to provide an example of the log and the search you are trying?