Reporting

splunk won't find fields with hyphens

matanryngler
Engager

I'm trying to search for data in splunk
if i do a search like: index="blabla-bla3" container_name="foo-foo2-sd4ofk4pokf4dspo54455c23c2b0d354" it won't find anything
but if i do: index="blabla-bla3" container_name="foo*foo2*sd4ofk4pokf4dspo54455c23c2b0d354" and replace - with * i get all the results normally.
is this a known issue?

0 Karma

tango
New Member
container_name="foo-foo2-sd4ofk4pokf4dspo54455c23c2b0d354" 

This should work. If it is not, I would look at the _raw event and make sure the hyphens aren't encoded or something. As mentioned earlier, you can't wildcard breaking characters, so the asterisk solution isn't expected to work. You can use the decimal wildcard in regex for the hyphen though. 

search | regex container_name="foo.foo2.sd4ofk4pokf4dspo54455c23c2b0d354"

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The hyphen is a breaking character, meaning it separates terms. To get Splunk to include breakers, try the TERM function.

index="blabla-bla3" container_name=TERM(foo-foo2-sd4ofk4pokf4dspo54455c23c2b0d354)
---
If this reply helps you, Karma would be appreciated.

matanryngler
Engager

didn'r work for me unfortunately, replaced = with :: and it worked ok:
index="blabla-bla3" container_name::foo-foo2-sd4ofk4pokf4dspo54455c23c2b0d354

richgalloway
SplunkTrust
SplunkTrust

@matanryngler To help future readers find your solution, please post it as an answer to this question and then accept it.

---
If this reply helps you, Karma would be appreciated.
0 Karma

PowerPacked
Builder

Hi

Try this

index="blabla-bla3" | search container_name="foo-foo2-sd4ofk4pokf4dspo54455c23c2b0d354"

if above doesn't work you need to add below stanza to fields.conf on search head,

[container_name]
INDEXED_VALUE = false

Thanks

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...