Ran into this recently, putting them together in a fields.conf file on the search head will make them searchable without needing the wildcards since they're metadata fields. [k8s.cluster.name] INDEXED=true [k8s.container.name] INDEXED=true [k8s.namespace.name] INDEXED=true [k8s.node.name] INDEXED=true [k8s.pod.name] INDEXED=true [k8s.pod.uid] INDEXED=true ... View more

If anyone ever runs into this in the future and are having issues like I was, everything in this post applies but even though you are calling | inputlookup and your searching time frame doesn't apply to bringing back results, you do need to search over the range for the sparkline to form properly.  Basically for a 30 days sparkline, making sure you run the search over the last 30 days even though its not actually searching 30 days of events. ... View more