In this case, you need to have the fields.conf on your search head (where you’re searching.)
Additionally, there is an inherent difference between a search for field=a and field::a
The later of these is relevant for indexed fields. Search through your job inspector to see how the jobs are parsed differently.
... View more