I re-did some of my data inputs using the same indexes as before to add actual sourcetypes this time. I'm using HWF instead of UF to send data to my indexer. I can now search "index=my_index sourcetype=my_sourcetype", but when my search is just "sourcetype=my_sourcetype", it returns no results over the same time period. Is there a way to fix that? It happened with a couple of sourcetypes, but not all of them.
This may be a security related issue as "Indexes searched by default" will cause the user to only search which he/she is provisioned for.
Check the role that is assigned to the user. Verify that my_index is in that list.
(edit weird post bug)
This may be a security related issue as "Indexes searched by default" will cause the user to only search which he/she is provisioned for.
Check the role that is assigned to the user. Verify that my_index is in that list.
(edit weird post bug)
Yeah, that's it. Thanks!
If I had to guess, the sourcetypes that return results are not returning results from my_index, but rather from other indexes? (check out the interesting fields)