topic Why does searching by source not work sometimes? in Splunk Search

Why does searching by source not work sometimes?

gbronner_rbc — Tue, 20 Oct 2015 20:55:45 GMT

This command does not work.

index=grb_test sourcetype=QServiceManagerFormat |  source="\\\\netapp4\\Quants\\ST\logs\\dailyTest20151020_152356rhbyvk\\qservicemanager.20151020.log"

This one returns results:

index=grb_test sourcetype=QServiceManagerFormat 
| where source="\\\\netapp4\\Quants\\ST\logs\\dailyTest20151020_152356rhbyvk\\qservicemanager.20151020.log"

I cannot figure out a reason why. I've tried all manner of escaping the source field in the first search, but can't get it to work.

Re: Why does searching by source not work sometimes?

abhijitmishra87 — Tue, 20 Oct 2015 22:06:51 GMT

I think the only thing that should follow a pipe( | ) is a splunk command, not a field name.

That is why it worked when you placed a command, 'where' in your case.

Your search should simply be:

index=grb_test sourcetype=QServiceManagerFormat source="\\\\netapp4\\Quants\\ST\logs\\dailyTest20151020_152356rhbyvk\\qservicemanager.20151020.log"

Re: Why does searching by source not work sometimes?

gbronner_rbc — Tue, 29 Sep 2020 07:38:57 GMT

Unfortunately, that does't work either; -- the pipe in the first input was actually an artifact of editing.

The query:
index=grb_test sourcetype=QServiceManagerFormat source="\\netapp4\Quants\ST\logs\dailyTest20151020_152356rhbyvk\qservicemanager.20151020.log"

produces zero rows.