topic Re: What is the best way to search email subjects by "is" or "contains"? in Splunk Search

What is the best way to search email subjects by "is" or "contains"?

packet_hunter — Wed, 20 Jan 2016 21:25:45 GMT

Scenarios:

1) searching email logs for an exact subject so I use quotes

index=mail sourcetype=xemail subject = "exact subject"

2) searching email logs for subjects that contains [blah blah] so I use *

index=mail sourcetype=xemail subject = *blah blah*

But what about * "blah blah" or * "blah blah" * or "blah blah" * ?

Can anyone explain the best way to search by "is" or "contains" ?

Thank you

somesoni2 — Wed, 20 Jan 2016 22:44:14 GMT

It should be "blah blah" , preferably inside double quotes, for 'contains'. For 'is', subject="Full exact string" shoud work fine.

packet_hunter — Thu, 21 Jan 2016 00:15:22 GMT

Thank you, you are correct, I was just wondering about the * because that works too but I will use your method 🙂