TERM(): How does it work under the covers ?

bdunstan — Fri, 01 Oct 2021 00:06:13 GMT

Hi,

I have a query which I am not sure why its not working,

Assume I have the following JSON record, which has been extracted at index-time

index: network
sourcetype: devices
record: { "deviceId" : 1234, "hostName": "Router1}

1. index=network sourcetype=devices deviceId=1234 => works as expected

2. index=network TERM(sourcetype::devices) => works as expected
3. index=network TERM(sourcetype::devices) deviceId=1234 => Fails, returns 0 records
4. index=network TERM(sourcetype::devices) earliest=-7d@d => Fails, returns 0 records

5. index=network sourcetype::devices deviceId=1234 => works as expected
6. index=network sourcetype::devices deviceId::1234 => works as expected
7. index=network sourcetype::devices deviceId::1234 earliest=-7d@d => works as expected

The real question is, why do queries 3 and 4 fail, when the others work, especially when I can see that query 2 works and returns the correct data.

What impact does TERM() have in the process flow, such that earliest and = make it fail ?

cheers
-brett

Re: TERM(): How does it work under the covers ?

PradReddy — Sun, 24 Oct 2021 21:31:48 GMT

Hi bdunstan,

Can you please run searches (3) and (4) to see how lipsy searches differ in the search.log and then we can narrow down to issue for failures

In general TERM Match whatever is inside the parentheses as a single term in the index, even if it contains characters that are usually recognized as minor segmenters, such as periods or underscores.

Here's some good documentation on this.
https://docs.splunk.com/Documentation/Splunk/6.4.2/Search/UseCASEandTERMtomatchphrases

------

An upvote would be appreciated and Accept Solution if it helps!

topic TERM(): How does it work under the covers ? in Splunk Search

TERM(): How does it work under the covers ?

Re: TERM(): How does it work under the covers ?