https://community.splunk.com/t5/Splunk-Search/Using-the-like-operator-for-raw-text/m-p/309242#M160235 <P>Try this.</P> <PRE><CODE>index="css_dev_logs" service=Policebox | spath loggername | search loggername=HealthCheckService | where like(message, "%\"Healthy\":[\"PasswordHealthCheck\"]%") </CODE></PRE> Tue, 11 Jul 2017 16:03:48 GMT richgalloway 2017-07-11T16:03:48Z https://community.splunk.com/t5/Splunk-Search/Using-the-like-operator-for-raw-text/m-p/309241#M160234 <P>Hi</P> <P>Can someone help me with a query please. So I have a field called message which displays the following:</P> <PRE><CODE>"message":"{\"Status\":\"HEALTHY\",\"Healthy\":[\"PasswordHealthCheck\"],\"Unhealthy\":[],\"Timestamp\":\"2017-07-11T14:08:08\",\"BuildNumber\":\"build-397-deploy-340\"}" </CODE></PRE> <P>So far my query is like so:</P> <PRE><CODE>index="css_dev_logs" service=Policebox | spath loggername | search loggername=HealthCheckService </CODE></PRE> <P>how can I append add to it to say where message \"Healthy\":[\"PasswordHealthCheck\"]</P> <P>Any help would be greatly appreciated</P> <P>Thanks</P> <P>Rob</P> Tue, 11 Jul 2017 14:12:29 GMT https://community.splunk.com/t5/Splunk-Search/Using-the-like-operator-for-raw-text/m-p/309241#M160234 dadomor 2017-07-11T14:12:29Z https://community.splunk.com/t5/Splunk-Search/Using-the-like-operator-for-raw-text/m-p/309242#M160235 <P>Try this.</P> <PRE><CODE>index="css_dev_logs" service=Policebox | spath loggername | search loggername=HealthCheckService | where like(message, "%\"Healthy\":[\"PasswordHealthCheck\"]%") </CODE></PRE> Tue, 11 Jul 2017 16:03:48 GMT https://community.splunk.com/t5/Splunk-Search/Using-the-like-operator-for-raw-text/m-p/309242#M160235 richgalloway 2017-07-11T16:03:48Z https://community.splunk.com/t5/Splunk-Search/Using-the-like-operator-for-raw-text/m-p/309243#M160236 <P>Thank you Rich</P> Wed, 12 Jul 2017 09:30:13 GMT https://community.splunk.com/t5/Splunk-Search/Using-the-like-operator-for-raw-text/m-p/309243#M160236 dadomor 2017-07-12T09:30:13Z