Does the plugin handle wildcards? about elasticsplunk HOT 5 OPEN

On Tue, Jul 17, 2018 at 4:38 AM, Bruno Moura ***@***.***> wrote: Hi @bossi6of9 <https://github.com/bossi6of9>, I wasn't able to reproduce it with very similar parameters searching against large indices. Can you confirm that this search works in kibana dev tools or using curl ? GET nprobe-2018.07.03/_search { "sort": [{"timestamp": {"order": "asc"}}], "query": { "bool": { "must": [ { "range": { "timestamp": { "gte": "now-360m", "lte": "now" } } }, { "query_string": { "query": "IPV4_DST_ADDR:1.2.3*" } } ] } } } — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#17 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/Aih4LR80mos8F_PwP_ToIXGFrPWG9HzVks5uHaJpgaJpZM4VD8Xz> .

On Tue, Jul 17, 2018 at 9:12 AM, Scott Bossi ***@***.***> wrote: Thanks for getting back to me. When I enter that in the Kibana console, I get: { "error": { "root_cause": [ { "type": "query_shard_exception", "reason": "No mapping found for [timestamp] in order to sort on", "index_uuid": "9FfQwC2aR7KoQAZEOuTBtw", "index": "netflow-2018.07.17" } ], "type": "search_phase_execution_exception", "reason": "all shards failed", "phase": "query", "grouped": true, "failed_shards": [ { "shard": 0, "index": "netflow-2018.07.17", "node": "hmTS1JVQS8-MEXeBpRUP8A", "reason": { "type": "query_shard_exception", "reason": "No mapping found for [timestamp] in order to sort on", "index_uuid": "9FfQwC2aR7KoQAZEOuTBtw", "index": "netflow-2018.07.17" } } ] }, "status": 400 } If I use discover, and use a wildcard, it works. If I try it on the splunk search bar, the job never finishes. On Tue, Jul 17, 2018 at 4:38 AM, Bruno Moura ***@***.***> wrote: > Hi @bossi6of9 <https://github.com/bossi6of9>, > I wasn't able to reproduce it with very similar parameters searching > against large indices. > > Can you confirm that this search works in kibana dev tools or using curl ? > > GET nprobe-2018.07.03/_search > { > "sort": [{"timestamp": {"order": "asc"}}], > "query": { > "bool": { > "must": [ > { > "range": { > "timestamp": { > "gte": "now-360m", > "lte": "now" > } > } > }, > { > "query_string": { > "query": "IPV4_DST_ADDR:1.2.3*" > } > } > ] > } > } > } > > — > You are receiving this because you were mentioned. > Reply to this email directly, view it on GitHub > <#17 (comment)>, > or mute the thread > <https://github.com/notifications/unsubscribe-auth/Aih4LR80mos8F_PwP_ToIXGFrPWG9HzVks5uHaJpgaJpZM4VD8Xz> > . >