Hello,
I have records that look like this:
2012-09-24T18:31:38: ^^ AAA ^^ BBB ^^ CCC ^^^ DDD ^^^ EEE
The records get parsed correctly and values are assigned to field names at index time - i.e fld1=AAA, fld2=BBB, etc.
However, when you use these field/value pairs in a search, no events are returned.
E.g. The search, index=xxx fld1=AAA, results in 0 events found.
Any ideas on what's going on here?
Thanks!
You should not use index-time extractions unless you have a very good reason for doing so and really know what you're doing. Index-time extractions affect performance negatively. You should always use search-time extractions unless there's a specific reason for not doing so.
This blog post covers the problem you might be running into: http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/