https://community.splunk.com/t5/Splunk-Search/how-to-get-events-for-exact-matched-string-only-in-the-field/m-p/362310#M107037 <P>I'm not sure if that's true. The <CODE>index=web account_domain="INCCORP"</CODE> should give events only with field account_domain has exact, but case in-sensitive, value <CODE>INCCORP</CODE>, as you're not using any wildcard here. Can you run following and see if you get just one row with account_domain=INCCORP or multiple rows for variations for it.</P> <PRE><CODE>index=web account_domain="INCCORP" | stats count by account_domain </CODE></PRE> Tue, 29 Sep 2020 19:14:56 GMT somesoni2 2020-09-29T19:14:56Z https://community.splunk.com/t5/Splunk-Search/how-to-get-events-for-exact-matched-string-only-in-the-field/m-p/362308#M107035 <P>I am searching :</P> <P>index=web account_domain="INCCORP"</P> <P>bur getting result which have account_doamain with "INCCORP","INCCOPR.NET", "-", "INCCORP.JIP" and so on(all field which have INCCORP in it)</P> <P>Is there any query or command which will give events for only "INCCORP"? I would like to exclude remaining.<BR /> Much appreciate with your help.</P> Wed, 25 Apr 2018 17:00:13 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-events-for-exact-matched-string-only-in-the-field/m-p/362308#M107035 Meharkant123 2018-04-25T17:00:13Z https://community.splunk.com/t5/Splunk-Search/how-to-get-events-for-exact-matched-string-only-in-the-field/m-p/362309#M107036 <P>That behavior does not sound right. However, there are several options for making sure. Here are two...</P> <PRE><CODE>| where (account_domain="INCCORP") | search match(account_domain,"^INCCORP$") </CODE></PRE> Wed, 25 Apr 2018 17:34:07 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-events-for-exact-matched-string-only-in-the-field/m-p/362309#M107036 DalJeanis 2018-04-25T17:34:07Z https://community.splunk.com/t5/Splunk-Search/how-to-get-events-for-exact-matched-string-only-in-the-field/m-p/362310#M107037 <P>I'm not sure if that's true. The <CODE>index=web account_domain="INCCORP"</CODE> should give events only with field account_domain has exact, but case in-sensitive, value <CODE>INCCORP</CODE>, as you're not using any wildcard here. Can you run following and see if you get just one row with account_domain=INCCORP or multiple rows for variations for it.</P> <PRE><CODE>index=web account_domain="INCCORP" | stats count by account_domain </CODE></PRE> Tue, 29 Sep 2020 19:14:56 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-events-for-exact-matched-string-only-in-the-field/m-p/362310#M107037 somesoni2 2020-09-29T19:14:56Z https://community.splunk.com/t5/Splunk-Search/how-to-get-events-for-exact-matched-string-only-in-the-field/m-p/362311#M107038 <P>my query was index=* account_domain="INCCORP"</P> <P>result was like account_doamain with "INCCORP","INCCOPR.NET", "-", </P> Thu, 26 Apr 2018 06:34:48 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-events-for-exact-matched-string-only-in-the-field/m-p/362311#M107038 Meharkant123 2018-04-26T06:34:48Z