Why is where command not working with Splunk events?

ghostrider — Tue, 11 Oct 2022 15:24:47 GMT

I want to search below events in the base search. However these are not getting displayed when I use the where cmd. They are only getting shown when I use the spath and search cmd like below. Any idea why where cmd is not working even though the filter criteria is getting matched? Its working for other events with the same filter criteria belpw. Only difference I can see is the multi line stack_trace field that is missing in other events. Could that be the issue?

Query that does not give any results even though qualifying events are there

BASE_SEARCH | where like(MOP,"MC")

Query that yields the results

BASE_SEARCH | spath MOP | search MOP=MC

Event

{ LEVEL: ERROR MESSAGE: Failed to process stack_trace: Exception trace.. at blah at blah MOP: MC }

Re: Why is where command not working with Splunk events?

yuanliu — Tue, 11 Oct 2022 15:48:03 GMT

The most likely reason is because the JSON object is not extracted if your second search requires an extra spath. In fact, if you take that spath out in the second, or add that spath in the first, the two should give you the same results

topic Why is where command not working with Splunk events? in Splunk Search

Why is where command not working with Splunk events?

Re: Why is where command not working with Splunk events?