Installation

Issues with Splunk search behavior after upgrading from version 6.4.5 to 7.0.4.

Path Finder

Hi,

I upgraded my system from Splunk 6.4.5 to Splunk 7.
I found an issue with the search behavior.
Search:

 index=testindex | where asset = "up%20asset"

The above search produces results in 6.4.5 but not in 7.0.4
Has anything changed under the hood?
Any help is appreciated.

Labels (1)
0 Karma

Communicator

Can you try :
index=testindex asset = "up*asset"
or
..| where like(asset, "up%asset")

If no result, can you check if asset is extracted in the fields bar, by running only index=testindex, make sure you are running it in the smart mode.
If it's there then check the values to make sure up.. is there

0 Karma

Path Finder

Yes, it working. Using * at the end index=testindex asset = "up%20asset*" also works.
This also works ..| where like(asset, "up%asset")
But we cannot use where condition because we want to filter out as many assets as possible before the first pipe.
And we cannot use wildcards which may include other assets. We just want to be sure to filter only this one.
The problem here is for the same data it works in 6.4.5

0 Karma

Communicator

Can you try with version 7.0.3, I don't know I find this version the most stable..

0 Karma

SplunkTrust
SplunkTrust

Just to confirm your running this in smart mode?

Also the asset field is extracted as you expected?

0 Karma

Path Finder

Yes, Asset field is extracted. Actually, I just select the asset from the left sidebar after running index = testindex
But for same data and same asset, we get results in 6.4.5
Tried in all modes nothing happens. It does not work in the current 7.0.4 version.

0 Karma

SplunkTrust
SplunkTrust

So you are looking for a space in a URL in the events?

0 Karma

Path Finder

No, I am looking for the events with the exact asset value. That is how it is indexed. I can see on the left side event count for this asset when I run just index=testindex. But when I try to filter it does not bring the results. For the same event data and same search, it works in 6.4.5

0 Karma