I can search by the following field key,
test_field=*
and Splunk Web displayed the lists. Then I select the "test_field=testA"(so following keywords), but displayed no lists.
test_field=* test_field=testA
And the following search command display no result.
test_field=testA
Furthermore, I add "| search" between the two kewords, then displayed properly.
test_field=* | search test_field=testA
Why is this happened ? Thank you for helping.