topic Re: Issues with splunk search behavior in version 7.0.4 in Installation

Issues with Splunk search behavior after upgrading from version 6.4.5 to 7.0.4.

immortalraghava — Mon, 15 Jun 2020 20:30:35 GMT

Hi,

I upgraded my system from Splunk 6.4.5 to Splunk 7.
I found an issue with the search behavior.
Search:

 index=testindex | where asset = "up%20asset"

The above search produces results in 6.4.5 but not in 7.0.4
Has anything changed under the hood?
Any help is appreciated.

Re: Issues with splunk search behavior in version 7.0.4

cpetterborg — Thu, 28 Jun 2018 19:50:33 GMT

So you are looking for a space in a URL in the events?

Re: Issues with splunk search behavior in version 7.0.4

gjanders — Fri, 29 Jun 2018 01:19:43 GMT

Just to confirm your running this in smart mode?

Also the asset field is extracted as you expected?

Re: Issues with splunk search behavior in version 7.0.4

amiftah — Fri, 29 Jun 2018 01:27:21 GMT

Can you try :
index=testindex asset = "up*asset"
or
..| where like(asset, "up%asset")

If no result, can you check if asset is extracted in the fields bar, by running only index=testindex, make sure you are running it in the smart mode.
If it's there then check the values to make sure up.. is there

Re: Issues with splunk search behavior in version 7.0.4

immortalraghava — Fri, 29 Jun 2018 09:19:48 GMT

No, I am looking for the events with the exact asset value. That is how it is indexed. I can see on the left side event count for this asset when I run just index=testindex. But when I try to filter it does not bring the results. For the same event data and same search, it works in 6.4.5

Re: Issues with splunk search behavior in version 7.0.4

immortalraghava — Fri, 29 Jun 2018 09:23:24 GMT

Yes, Asset field is extracted. Actually, I just select the asset from the left sidebar after running index = testindex
But for same data and same asset, we get results in 6.4.5
Tried in all modes nothing happens. It does not work in the current 7.0.4 version.

Re: Issues with splunk search behavior in version 7.0.4

immortalraghava — Fri, 29 Jun 2018 09:27:44 GMT

Yes, it working. Using * at the end index=testindex asset = "up%20asset*" also works.
This also works ..| where like(asset, "up%asset")
But we cannot use where condition because we want to filter out as many assets as possible before the first pipe.
And we cannot use wildcards which may include other assets. We just want to be sure to filter only this one.
The problem here is for the same data it works in 6.4.5

Re: Issues with splunk search behavior in version 7.0.4

amiftah — Fri, 29 Jun 2018 11:26:53 GMT

Can you try with version 7.0.3, I don't know I find this version the most stable..