Splunk Search

Why can't I search for my extracted field?

mctester
Communicator

I have a store field brought in by a scripted lookup. it shows up when i do a search for sourcetype=foo, I can even stats count by store. but I can't search store=bar on the search bar... ?!

I thought that that this only happened for extracted fields where the value is not in the actual event

Tags (2)
1 Solution

Jason
Motivator

By default, Splunk will expand store=bar into (bar AND store=bar). If bar doesn't exist in your event, the event will not be returned.

If this is because store is an extracted field or lookup-based field, tell Splunk to not search for the text in the event by editing fields.conf:

[store]
INDEXED_VALUE = false

View solution in original post

Christian
Path Finder

Hi,

or just use the therm store::bar

greez christian

0 Karma

Jason
Motivator

By default, Splunk will expand store=bar into (bar AND store=bar). If bar doesn't exist in your event, the event will not be returned.

If this is because store is an extracted field or lookup-based field, tell Splunk to not search for the text in the event by editing fields.conf:

[store]
INDEXED_VALUE = false
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...