Splunk Search

Why is search in index not displaying results that are present but displaying when searching for more data?

GenericSplunkUs
Path Finder

I've got a problem and part of that problem is I'm not sure how to search for the solution.

Using Verbose search mode (others are the same though).

If I search index="*" User_Priority="High" I get no results returned.
But If I search index="*" User_Priority="High" OR User_Priority="Medium" | stats count by User_Priority I get results for the High Priority in the same time frame I searched above.

This is the same if I specify the index this data is in.

I don't understand this, and am looking on how I can get it fixed.

A very confused Splunker.

1 Solution

woodcock
Esteemed Legend

I assume that User_Priority is an extracted field and you are experiencing this unfortunate situation:

https://www.splunk.com/blog/2011/10/07/cannot-search-based-on-an-extracted-field.html

View solution in original post

0 Karma

woodcock
Esteemed Legend

I assume that User_Priority is an extracted field and you are experiencing this unfortunate situation:

https://www.splunk.com/blog/2011/10/07/cannot-search-based-on-an-extracted-field.html
0 Karma

GenericSplunkUs
Path Finder

This sounds like what I'm dealing with. I'll confirm then give you the 'accept' on your answer. Thanks!

0 Karma

woodcock
Esteemed Legend

You are probably using search mode (far right side between the histogram and the search results) setting of Fast. Switch to Smart or Verbose and both should work.

0 Karma

GenericSplunkUs
Path Finder

Both are being searched in Verbose mode. That was one of my thoughts but even in Fast or Smart this same thing happens.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...