Splunk Search

_meta not getting expected logs to splunk

rajpalyalla
Engager

Hello,

we have index "text-index"
and region is passed as meta
_meta = region::east
sourcetype = testlogs

when i query
index="text-index" sourcetype=testlogs

i see all the logs displayed.

when i use index="text-index" sourcetype=testlogs region="*" i see all the logs displayed

but when i use index="text-index" sourcetype=testlogs region="east" it will display the logs only which has word east. its supposed list all the like other two queries above. why does it gives me only if words match. please correct me if i'm doing anything wrong

Tags (2)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

rajpalyalla
Engager

i have already set this in fileds.conf
[region]
INDEXED=true

0 Karma

rajpalyalla
Engager

any other suggestions please?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...