Installation
Highlighted

Issues with Splunk search behavior after upgrading from version 6.4.5 to 7.0.4.

Path Finder

Hi,

I upgraded my system from Splunk 6.4.5 to Splunk 7.
I found an issue with the search behavior.
Search:

 index=testindex | where asset = "up%20asset"

The above search produces results in 6.4.5 but not in 7.0.4
Has anything changed under the hood?
Any help is appreciated.

Labels (1)
0 Karma
Highlighted

Re: Issues with splunk search behavior in version 7.0.4

SplunkTrust
SplunkTrust

So you are looking for a space in a URL in the events?

0 Karma
Highlighted

Re: Issues with splunk search behavior in version 7.0.4

Path Finder

No, I am looking for the events with the exact asset value. That is how it is indexed. I can see on the left side event count for this asset when I run just index=testindex. But when I try to filter it does not bring the results. For the same event data and same search, it works in 6.4.5

0 Karma
Highlighted

Re: Issues with splunk search behavior in version 7.0.4

SplunkTrust
SplunkTrust

Just to confirm your running this in smart mode?

Also the asset field is extracted as you expected?

0 Karma
Highlighted

Re: Issues with splunk search behavior in version 7.0.4

Path Finder

Yes, Asset field is extracted. Actually, I just select the asset from the left sidebar after running index = testindex
But for same data and same asset, we get results in 6.4.5
Tried in all modes nothing happens. It does not work in the current 7.0.4 version.

0 Karma
Highlighted

Re: Issues with splunk search behavior in version 7.0.4

Communicator

Can you try :
index=testindex asset = "up*asset"
or
..| where like(asset, "up%asset")

If no result, can you check if asset is extracted in the fields bar, by running only index=testindex, make sure you are running it in the smart mode.
If it's there then check the values to make sure up.. is there

0 Karma
Highlighted

Re: Issues with splunk search behavior in version 7.0.4

Path Finder

Yes, it working. Using * at the end index=testindex asset = "up%20asset*" also works.
This also works ..| where like(asset, "up%asset")
But we cannot use where condition because we want to filter out as many assets as possible before the first pipe.
And we cannot use wildcards which may include other assets. We just want to be sure to filter only this one.
The problem here is for the same data it works in 6.4.5

0 Karma
Highlighted

Re: Issues with splunk search behavior in version 7.0.4

Communicator

Can you try with version 7.0.3, I don't know I find this version the most stable..

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.