Can you try the following: ./splunk search 'index=**** sourcetype="*****:proxylogs" earliest=-15m@m latest=now | fields index,sourcetype,action,bytes,bytes_in,bytes_out,src,category,date_hour,date_mday,date_minute,date_month,date_second,date_wday,date_year,date_zone,url,site,domain,dest_ip,user,user_bunit,user_work_city,user_work_country,user_work_lat,user_work_long,_time | table index,sourcetype,action,bytes,bytes_in,bytes_out,src,category,date_hour,date_mday,date_minute,date_month,date_second,date_wday,date_year,date_zone,url,site,domain,dest_ip,user,user_bunit,user_work_city,user_work_country,user_work_lat,user_work_long,_time' Also do you not get any result even if you increase the time window for the search? I tried the following and it worked fine. (I had some data with csv sourcetype and did not have all the fields). ./splunk search 'index=**** sourcetype="*****_csv" earliest=-1mon latest=now | fields index,sourcetype,action,bytes,bytes_in,bytes_out,src,category,date_hour,date_mday,date_minute,date_month,date_second,date_wday,date_year,date_zone,url,site,domain,dest_ip,user,user_bunit,user_work_city,user_work_country,user_work_lat,user_work_long,_time | table index,sourcetype,action,bytes,bytes_in,bytes_out,src,category,date_hour,date_mday,date_minute,date_month,date_second,date_wday,date_year,date_zone,url,site,domain,dest_ip,user,user_bunit,user_work_city,user_work_country,user_work_lat,user_work_long,_time'
... View more