Archive

splunk won't find fields with hyphens

matanryngler
Engager

I'm trying to search for data in splunk
if i do a search like: index="blabla-bla3" container_name="foo-foo2-sd4ofk4pokf4dspo54455c23c2b0d354" it won't find anything
but if i do: index="blabla-bla3" container_name="foo*foo2*sd4ofk4pokf4dspo54455c23c2b0d354" and replace - with * i get all the results normally.
is this a known issue?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The hyphen is a breaking character, meaning it separates terms. To get Splunk to include breakers, try the TERM function.

index="blabla-bla3" container_name=TERM(foo-foo2-sd4ofk4pokf4dspo54455c23c2b0d354)
---
If this reply helps you, an upvote would be appreciated.

matanryngler
Engager

didn'r work for me unfortunately, replaced = with :: and it worked ok:
index="blabla-bla3" container_name::foo-foo2-sd4ofk4pokf4dspo54455c23c2b0d354

richgalloway
SplunkTrust
SplunkTrust

@matanryngler To help future readers find your solution, please post it as an answer to this question and then accept it.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

PowerPacked
Builder

Hi

Try this

index="blabla-bla3" | search container_name="foo-foo2-sd4ofk4pokf4dspo54455c23c2b0d354"

if above doesn't work you need to add below stanza to fields.conf on search head,

[container_name]
INDEXED_VALUE = false

Thanks

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on