Why is Splunk Search Not Working Properly?

[omera]

When we are doing searches on Splunk we are encountering a strange issue. For example, when I add sc4s_fromhostip=... to the search I can't see all the events, sometimes I can't see any results. Normally there are events. When I check with stats (... | stats count by sc4s_fromhostip) I can see the number of events. When I put a wildcard * to the end (sc4s_fromhostip=...*) then the number of events increases but still it doesn't show all of them.

If I do an eval and make a copy of the sc4s_fromhostip field it works properly and I can see all the results. Like ... | eval a=sc4s_fromhostip | a=…

* This happens on all the search heads in the cluster and outside the cluster.
* If I change the user it still continues.

Did anyone encounter a similar issue before?

[somesoni2]

Try to run your base search (without sc4s_fromhostip filter), then click on sc4s_fromhostip value on field Sidebar on left. it'll add the search filter to your main search with proper format. If there are any special character, extra spaces, it should tell you that.

[omera]

Hi somesoni2. I'm adding the field to the search by going over the field that Splunk has found and pressing add to search. So Splunk adds it from the results it has generated. But after it adds it to the search it doesn't show the events.