Splunk Search

_meta fields: why am I unable to search for all of the events?

godman
Path Finder

I am not able to search for all of the events from the fields. When i try field::value , I can see all of the events. But with field=value , only some of the events are searchable.
updated my fields.conf with [field] INDEXED = true , but do i also need to update my inputs.conf with the fields and its values? There are going to be more values for the fields, and it can be hard to update all of them?

Tags (3)

vasanthmss
Motivator

You are using indexed time extration. You have to supply required fileds props and transforms to the search peers. If you are using heavy forwarder confs should to be in hf.

https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/Configureindex-timefieldextraction

V
0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

Hi @godman,

Not sure if this helps, but I stumbled upon this answers post that seems similar to yours. Thought I'd pass it along just in case. https://answers.splunk.com/answers/389567/why-is-a-search-for-fields-added-with-meta-in-inpu.html

0 Karma

godman
Path Finder

In this example they only have one value for the field and in my case i have many values for each field and i am not able to add all of them to the inputs.conf .

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...