what does "::" do in splunk searches, I tried using it interchangably with "=" and it returned the same results. So is there any specific funstionality of "::"
That is getting a common key=value to LISPY syntax There was something in a .conf presentation:
foo="a" becomes [foo::a] in LISPY.
View solution in original post
there was already a similar questions. It has to do with the differences between indextime and searchtime field extraction. More inforomation here: https://answers.splunk.com/answers/411019/whats-the-difference-between-hostabc-and-hostabc.html