Splunk Search

Field search not working?

acontarciego
Explorer

Hello,

I have records that look like this:
2012-09-24T18:31:38: ^^ AAA ^^ BBB ^^ CCC ^^^ DDD ^^^ EEE

The records get parsed correctly and values are assigned to field names at index time - i.e fld1=AAA, fld2=BBB, etc.

However, when you use these field/value pairs in a search, no events are returned.

E.g. The search, index=xxx fld1=AAA, results in 0 events found.

Any ideas on what's going on here?

Thanks!

Tags (1)
0 Karma

Ayn
Legend

You should not use index-time extractions unless you have a very good reason for doing so and really know what you're doing. Index-time extractions affect performance negatively. You should always use search-time extractions unless there's a specific reason for not doing so.

This blog post covers the problem you might be running into: http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...