topic Re: Issue with search query in Splunk Search

Issue with search query

mamulani11 — Mon, 28 Sep 2020 16:12:16 GMT

I have User_Id field in my log. In the user_Id field I have value like john,sonia,ces\ts1,......
Now when i am searching for john & sonia
I am getting the exact answer
But when I am searching for ces/ts1.I am getting no result found.
Can anyone please tell me whats the error. Is that search command doesn't take "\".
Please help......

Re: Issue with search query

kristian_kolb — Fri, 21 Mar 2014 11:26:50 GMT

please provide your exact search queries, and a few sample lines of your log file.

Re: Issue with search query

somesoni2 — Mon, 28 Sep 2020 16:12:21 GMT

If there are special character in the field value, while searching then by value, your need to escape them. E.g. if user_id=ces/ts1 then in search use user_id="ces\/ts1"

Re: Issue with search query

martin_mueller — Fri, 21 Mar 2014 13:54:03 GMT

There appears to be a mix of forward slashes / and backslashes \ going on - make sure you're searching for the right kind.

Re: Issue with search query

the_wolverine — Tue, 08 Apr 2014 23:49:48 GMT

There are escape characters (particularly with the Windows Event Logs, I have noticed). If you're unsure of the syntax you can always search with a wildcard:

User_Id=*ts1

To the left of your results, you have a list of fields. Click on the User_Id field and select the match for your user "css/ts1". This will return the exact search string needed in the search bar for your reference.