_meta fields: why am I unable to search for all of the events?

[godman]

I am not able to search for all of the events from the fields. When i try field::value , I can see all of the events. But with field=value , only some of the events are searchable.
updated my fields.conf with [field] INDEXED = true , but do i also need to update my inputs.conf with the fields and its values? There are going to be more values for the fields, and it can be hard to update all of them?

[vasanthmss]

You are using indexed time extration. You have to supply required fileds props and transforms to the search peers. If you are using heavy forwarder confs should to be in hf.

https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/Configureindex-timefieldextraction

[mstjohn_splunk]

Hi @godman,

Not sure if this helps, but I stumbled upon this answers post that seems similar to yours. Thought I'd pass it along just in case. https://answers.splunk.com/answers/389567/why-is-a-search-for-fields-added-with-meta-in-inpu.html

[godman]

In this example they only have one value for the field and in my case i have many values for each field and i am not able to add all of them to the inputs.conf .