Splunk Search

simple search sourcetype=X finds events but wont display them - unless field is forced

Path Finder

this search: index=flowspaces sourcetype=auditlog produces search results that are not displayed in the ui.

if fields are forced, events are displayed.

Tags (2)
0 Karma
1 Solution

Path Finder

Argh.

I mistakenly overwrote a newer props.conf with one with a bad eval on _time.

That'll do it every time...

View solution in original post

0 Karma

Path Finder

Argh.

I mistakenly overwrote a newer props.conf with one with a bad eval on _time.

That'll do it every time...

View solution in original post

0 Karma

Path Finder

The captcha wont let me edit my OP. sorry.

this search:

index=flowspaces sourcetype=auditlog 

produces search results that are not displayed in the ui.

if fields are forced, events are displayed.

e.g.

index=flowspaces sourcetype=auditlog | fields extracted-field1 extracted-field2

This is a big problem for some very large search queries which rely on that sourcetype - the necessary data is available but not showing up in the searches and makes all saved searches useless.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!