Issues with Splunk search behavior after upgrading from version 6.4.5 to 7.0.4.

[immortalraghava]

Hi,

I upgraded my system from Splunk 6.4.5 to Splunk 7.
I found an issue with the search behavior.
Search:

 index=testindex | where asset = "up%20asset"

The above search produces results in 6.4.5 but not in 7.0.4
Has anything changed under the hood?
Any help is appreciated.

[amiftah]

Can you try :
index=testindex asset = "up*asset"
or
..| where like(asset, "up%asset")

If no result, can you check if asset is extracted in the fields bar, by running only index=testindex, make sure you are running it in the smart mode.
If it's there then check the values to make sure up.. is there

[immortalraghava]

Yes, it working. Using * at the end index=testindex asset = "up%20asset*" also works.
This also works ..| where like(asset, "up%asset")
But we cannot use where condition because we want to filter out as many assets as possible before the first pipe.
And we cannot use wildcards which may include other assets. We just want to be sure to filter only this one.
The problem here is for the same data it works in 6.4.5

[amiftah]

Can you try with version 7.0.3, I don't know I find this version the most stable..

[gjanders]

Just to confirm your running this in smart mode?

Also the asset field is extracted as you expected?

[immortalraghava]

Yes, Asset field is extracted. Actually, I just select the asset from the left sidebar after running index = testindex
But for same data and same asset, we get results in 6.4.5
Tried in all modes nothing happens. It does not work in the current 7.0.4 version.

[cpetterborg]

So you are looking for a space in a URL in the events?

[immortalraghava]

No, I am looking for the events with the exact asset value. That is how it is indexed. I can see on the left side event count for this asset when I run just index=testindex. But when I try to filter it does not bring the results. For the same event data and same search, it works in 6.4.5