I have a store field brought in by a scripted lookup. it shows up when i do a search for sourcetype=foo, I can even stats count by store. but I can't search store=bar on the search bar... ?!
I thought that that this only happened for extracted fields where the value is not in the actual event
By default, Splunk will expand store=bar into (bar AND store=bar). If bar doesn't exist in your event, the event will not be returned.
(bar AND store=bar)
If this is because store is an extracted field or lookup-based field, tell Splunk to not search for the text in the event by editing fields.conf:
INDEXED_VALUE = false
View solution in original post
or just use the therm store::bar