splunk won't find fields with hyphens

[matanryngler]

I'm trying to search for data in splunk
if i do a search like: index="blabla-bla3" container_name="foo-foo2-sd4ofk4pokf4dspo54455c23c2b0d354" it won't find anything
but if i do: index="blabla-bla3" container_name="foo*foo2*sd4ofk4pokf4dspo54455c23c2b0d354" and replace - with * i get all the results normally.
is this a known issue?

[tango]

container_name="foo-foo2-sd4ofk4pokf4dspo54455c23c2b0d354" 

This should work. If it is not, I would look at the _raw event and make sure the hyphens aren't encoded or something. As mentioned earlier, you can't wildcard breaking characters, so the asterisk solution isn't expected to work. You can use the decimal wildcard in regex for the hyphen though. 

search | regex container_name="foo.foo2.sd4ofk4pokf4dspo54455c23c2b0d354"

[richgalloway]

The hyphen is a breaking character, meaning it separates terms. To get Splunk to include breakers, try the TERM function.

index="blabla-bla3" container_name=TERM(foo-foo2-sd4ofk4pokf4dspo54455c23c2b0d354)

[matanryngler]

didn'r work for me unfortunately, replaced = with :: and it worked ok:
index="blabla-bla3" container_name::foo-foo2-sd4ofk4pokf4dspo54455c23c2b0d354

[richgalloway]

@matanryngler To help future readers find your solution, please post it as an answer to this question and then accept it.

[PowerPacked]

Hi

Try this

index="blabla-bla3" | search container_name="foo-foo2-sd4ofk4pokf4dspo54455c23c2b0d354"

if above doesn't work you need to add below stanza to fields.conf on search head,

[container_name]
INDEXED_VALUE = false

Thanks