Why can't I search for my extracted field?

[mctester]

I have a store field brought in by a scripted lookup. it shows up when i do a search for sourcetype=foo, I can even stats count by store. but I can't search store=bar on the search bar... ?!

I thought that that this only happened for extracted fields where the value is not in the actual event

[Christian]

Hi,

or just use the therm store::bar

greez christian

[Jason · Accepted solution]

By default, Splunk will expand store=bar into (bar AND store=bar). If bar doesn't exist in your event, the event will not be returned.

If this is because store is an extracted field or lookup-based field, tell Splunk to not search for the text in the event by editing fields.conf:

[store]
INDEXED_VALUE = false