Splunk Search

My automatic lookup field is not searchable unless I pipe search for it.

katelynengel
Explorer

I am trying to run the following search in Splunk:

index=index1 sourcetype=sourcetype1 bldg=XI

The bldg field is an automatic lookup field and exists in 100% of the events for index=index1 & sourcetype=sourcetype1. However, when I run this search, I only get back less then 1% of the results I would expect.

When I run the search as follows, I get back all of the results I am looking for.

index=index1 sourcetype=sourcetype1 | search bldg=XI

Why do I need to pipe search to get the correct results?

I am using Splunk 6.0.2

Tags (3)
0 Karma

TaylorWhitt
Explorer

It sounds like you don't have a field extraction set up for bldg. The following documentation will explain why, a lot better than I can.

http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/WhenSplunkEnterpriseaddsfields
http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Indextimeversussearchtime

Default field extractions have to be common to every entry. By identifying the different sourcetype and index, is making the bldg field common to all entries. Then you're performing another search where your string would match.

I could be wrong, but I am going to guess there is an entry where bldg has a value with a space in it?

0 Karma

katelynengel
Explorer

There must be an invisible space in my lookup table because when I run the search as follows, it works as expected:

index=index1 sourcetype=sourcetype1 bldg=XI*

0 Karma

katelynengel
Explorer

That still doesn't answer though why it works without the * if I | search.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...