Hello Splunk world,
I am having a weird issue where I am seeing SourceTypes that are not searchable.
If i click into Search and Reporting and select the Data Summary, under the SourceTypes tab I see 61 SourceTypes.
However,
If i run a search that is something like " | metadata type=sourcetypes index=* " I get 147 SourceTypes listed.
One of those "hidden" SourceTypes is the data I need to search against.
Anyone have any ideas why/how this is happening?
You are probably relying on Indexes searched by default
which is a VERY bad habit. Try this:
index=* OR index=_* sourcetype=MyHiddenSourceType
Then, when you figure out what index has your sourcetype, you can do this:
index=IndexForMyHiddenSourctype sourcetype=MyHiddenSourceType
Thank you for the feedback. I'd though about that and we are using the query "Index=* sourcetype=HiddenSourceType" still no luck.
I see that sourcetype available in "|metadata" with current epoch time, but I get no results running over any timeframe. I know the data is there, it's just not letting me search through it.