I ran the search that returned no results.
index=_internal source="metrics.log" splunk_server="" group= "per_index_thruput" | eval MB=kb/1024 | chart sum(MB) by series | sort - sum(MB)
I can see there is raw data, but as soon as I added group=per_index_thruput, no results found. Somehow, it does not recognize the field “group” despite the field shows up in the left menu. I can workaround it by surrounding it with double quotes "group=per_index_thruput" which forces splunk to search on the entire string — or just use per_index_thruput.
I had a similar issue too, and it turned out that there was a fields.conf file in one of my custom apps which has the following entries:
[default]
INDEXED = true
I believe the the default should be indexed=false. Anyway, once I have deleted this un-needed fields.conf file, and restarted splunk, my fields resumed working again.
Which app? That should be addressed.
my custom app