Splunk Search

simple search sourcetype=X finds events but wont display them - unless field is forced

Path Finder

this search: index=flowspaces sourcetype=auditlog produces search results that are not displayed in the ui.

if fields are forced, events are displayed.

Tags (2)
0 Karma
1 Solution

Path Finder

Argh.

I mistakenly overwrote a newer props.conf with one with a bad eval on _time.

That'll do it every time...

View solution in original post

0 Karma

Path Finder

Argh.

I mistakenly overwrote a newer props.conf with one with a bad eval on _time.

That'll do it every time...

View solution in original post

0 Karma

Path Finder

The captcha wont let me edit my OP. sorry.

this search:

index=flowspaces sourcetype=auditlog 

produces search results that are not displayed in the ui.

if fields are forced, events are displayed.

e.g.

index=flowspaces sourcetype=auditlog | fields extracted-field1 extracted-field2

This is a big problem for some very large search queries which rely on that sourcetype - the necessary data is available but not showing up in the searches and makes all saved searches useless.

0 Karma