Splunk Search

Why can't I search for my extracted field?

mctester
Communicator

I have a store field brought in by a scripted lookup. it shows up when i do a search for sourcetype=foo, I can even stats count by store. but I can't search store=bar on the search bar... ?!

I thought that that this only happened for extracted fields where the value is not in the actual event

Tags (2)
1 Solution

Jason
Motivator

By default, Splunk will expand store=bar into (bar AND store=bar). If bar doesn't exist in your event, the event will not be returned.

If this is because store is an extracted field or lookup-based field, tell Splunk to not search for the text in the event by editing fields.conf:

[store]
INDEXED_VALUE = false

View solution in original post

Christian
Path Finder

Hi,

or just use the therm store::bar

greez christian

0 Karma

Jason
Motivator

By default, Splunk will expand store=bar into (bar AND store=bar). If bar doesn't exist in your event, the event will not be returned.

If this is because store is an extracted field or lookup-based field, tell Splunk to not search for the text in the event by editing fields.conf:

[store]
INDEXED_VALUE = false
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...