https://community.splunk.com/t5/Splunk-Search/newbie-question/m-p/153114#M42950 <P>The data is in JSOn format, would that make a difference?</P> Fri, 22 Nov 2013 21:59:41 GMT simplywibble 2013-11-22T21:59:41Z https://community.splunk.com/t5/Splunk-Search/newbie-question/m-p/153111#M42947 <P>Hi</P> <P>basic question.</P> <P>How do i search data and return results on content that has a colon in it?</P> <P>Such as</P> <P>Server: Apache<BR /> Server: Apache/2.2.3</P> <P>or</P> <P>Content-Length: 200</P> <P>Do i need to use regex to break it out?</P> <P>Thanks</P> <P>Dan</P> Fri, 22 Nov 2013 19:22:41 GMT https://community.splunk.com/t5/Splunk-Search/newbie-question/m-p/153111#M42947 simplywibble 2013-11-22T19:22:41Z https://community.splunk.com/t5/Splunk-Search/newbie-question/m-p/153112#M42948 <P>surrounding the search string in double quotes should be sufficient (ie. "Server: Apache"). Is that not working?</P> Fri, 22 Nov 2013 19:25:03 GMT https://community.splunk.com/t5/Splunk-Search/newbie-question/m-p/153112#M42948 anssntaco 2013-11-22T19:25:03Z https://community.splunk.com/t5/Splunk-Search/newbie-question/m-p/153113#M42949 <P>As far as I have seen, you can directly provide the content in the search and it works with (best practice) or without quotes.<BR /> e.g. index=abc http://<BR /><BR /> index=abc "http://"</P> Fri, 22 Nov 2013 19:48:55 GMT https://community.splunk.com/t5/Splunk-Search/newbie-question/m-p/153113#M42949 somesoni2 2013-11-22T19:48:55Z https://community.splunk.com/t5/Splunk-Search/newbie-question/m-p/153114#M42950 <P>The data is in JSOn format, would that make a difference?</P> Fri, 22 Nov 2013 21:59:41 GMT https://community.splunk.com/t5/Splunk-Search/newbie-question/m-p/153114#M42950 simplywibble 2013-11-22T21:59:41Z