Other Usage

splunk won't find fields with hyphens

matanryngler
Engager

I'm trying to search for data in splunk
if i do a search like: index="blabla-bla3" container_name="foo-foo2-sd4ofk4pokf4dspo54455c23c2b0d354" it won't find anything
but if i do: index="blabla-bla3" container_name="foo*foo2*sd4ofk4pokf4dspo54455c23c2b0d354" and replace - with * i get all the results normally.
is this a known issue?

0 Karma

tango
New Member
container_name="foo-foo2-sd4ofk4pokf4dspo54455c23c2b0d354" 

This should work. If it is not, I would look at the _raw event and make sure the hyphens aren't encoded or something. As mentioned earlier, you can't wildcard breaking characters, so the asterisk solution isn't expected to work. You can use the decimal wildcard in regex for the hyphen though. 

search | regex container_name="foo.foo2.sd4ofk4pokf4dspo54455c23c2b0d354"

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The hyphen is a breaking character, meaning it separates terms. To get Splunk to include breakers, try the TERM function.

index="blabla-bla3" container_name=TERM(foo-foo2-sd4ofk4pokf4dspo54455c23c2b0d354)
---
If this reply helps you, Karma would be appreciated.

matanryngler
Engager

didn'r work for me unfortunately, replaced = with :: and it worked ok:
index="blabla-bla3" container_name::foo-foo2-sd4ofk4pokf4dspo54455c23c2b0d354

richgalloway
SplunkTrust
SplunkTrust

@matanryngler To help future readers find your solution, please post it as an answer to this question and then accept it.

---
If this reply helps you, Karma would be appreciated.
0 Karma

PowerPacked
Builder

Hi

Try this

index="blabla-bla3" | search container_name="foo-foo2-sd4ofk4pokf4dspo54455c23c2b0d354"

if above doesn't work you need to add below stanza to fields.conf on search head,

[container_name]
INDEXED_VALUE = false

Thanks

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...