topic Re: Can find a field value only when using a wildcard prefix in Splunk Search

Can find a field value only when using a wildcard prefix

ilyar — Thu, 22 Oct 2020 14:34:12 GMT

Hello,

I have field name: let's call it - "foo" and a value I desire to add to my search - "bar".
When I execute a normal query, for example:

index="main" sourcetype="blabla" foo="bar"

it won't find anything, although I know there are many events that have the field foo=bar
Alternatively, when I execute the following query:

index="main" sourcetype="blabla" foo="*bar"

I get the results I want.

What causes the first search, which should work, to fail? Is that encoding issue?

Thanks!

Re: Can find a field value only when using a wildcard prefix

ITWhisperer — Thu, 22 Oct 2020 15:48:45 GMT

Can you share your events?

Re: Can find a field value only when using a wildcard prefix

ilyar — Thu, 22 Oct 2020 18:56:53 GMT

Hi buddy, unfortunately not, it's sensitive data. I'm sure people had the same problem. I believe it has to do with encoding...

Re: Can find a field value only when using a wildcard prefix

kennetkline — Thu, 22 Oct 2020 19:34:43 GMT

Sounds like maybe a transforms/props issue.

If you are getting hits with the wildcard, I would believe there is a whitespace issue; (where a leading space or more exists in the value.

Re: Can find a field value only when using a wildcard prefix

ilyar — Sun, 25 Oct 2020 06:22:09 GMT

Hi! I tried to search with a numerous amouns of spaces, yet it cannot find the value. Using the wildcard works, however.
Maybe you have an idea as to how to confirm that?

thanks!

Re: Can find a field value only when using a wildcard prefix

ITWhisperer — Sun, 25 Oct 2020 08:14:57 GMT

index="main" sourcetype="blabla" | rex "foo=\"(?<characters>.*)bar\"" | fields characters

Re: Can find a field value only when using a wildcard prefix

isoutamo — Sun, 25 Oct 2020 20:41:38 GMT

Can you check what your job inspection said on those rows which contains word lispy?