Not able to search fields with "="

Applicability

Splunk Enterprise Splunk Cloud

Description

Splunk version: 7.0.13

When trying to search one of the following fields by matching a string:

• pod
• namespace
• container_name
• container_id

Like container_id=aadd1, won't return results.

Investigation

After some research it was noticed that HEC data on this configuration is indexed without any configuration file, but for using it properly some configuration is needed. The fields can be in fact searchable by setting with the 
:: sign (metadata fields specifier) but this doesn't fix the fact that they can not be search with the = sign.

To have this working further configurations must be performed on search. Seems like when having HEC inputs for GCP kubernets the events are not fully prepared to be searchable. Particularly the fields seem to remain not indexed, which is part of the data raw data but not to be specified on the search for getting events.

Resolution

Since events don't get indexed configuration parameters must be added as follows:

Instance: Search head

File: fields.conf

Path: $SPLUNK_HOME/etc/apps/search/local

Setting: Add each field as a stanza with the parameter INDEXED=true as follows.
 

[pod]
INDEXED=true[namespace]
INDEXED=true[container_name]
INDEXED=true[container_id]
INDEXED=true

After this, the search head needs to be restarted, and with this, new events coming will be searchable with the = sign.

Related Links

Splunk Answers
Why do I need to search metadata in a "fields" argument of an HEC with '::'?: 
https://answers.splunk.com/answers/635676/why-do-i-need-to-search-metadata-in-a-fields-argum.html

External Links
Kubernetes-logging settings: 
https://github.com/splunk/splunk-connect-for-kubernetes/tree/develop/helm-chart/splunk-kubernetes-logging

Revision History

Revision	Publish Date	Comments
1.0	28-Sep-2026	Initial Release