Why is Splunk giving different result when searching on _bkt field?

[bhavikbhalodia]

While running below search I am not getting any events:

index=main_vulnerability_database sourcetype=vulnerability_overview _bkt="main_vulnerability_database~0~FB1A6C9D-87F2-4A38-B420-94F2171CE493" _cd=0:1015

But while adding search command I am getting events:

index=main_vulnerability_database sourcetype=vulnerability_overview

| search _bkt="main_vulnerability_database~0~FB1A6C9D-87F2-4A38-B420-94F2171CE493" _cd=0:1015

Ideally both should give same results.  Looking for reason why it is happening.

[isoutamo]

Hi

if I recall right splunk is not supporting to use (most) _xyz fields on base search. Some of those works with separate search/where command. Also some of those needs to copy to another fields to use/show on results (e.g. _indextime).

r. Ismo