Splunk Search

Can find a field value only when using a wildcard prefix

ilyar
Observer

Hello,

I have field name: let's call it - "foo" and a value I desire to add to my search - "bar".
When I execute a normal query, for example: 

 

 

 

 

index="main" sourcetype="blabla" foo="bar"

 

 

 

 

it won't find anything, although I know there are many events that have the field foo=bar
Alternatively, when I execute the following query:

 

 

 

 

index="main" sourcetype="blabla" foo="*bar"

 

 

 

 

 I get the results I want. 

What causes the first search, which should work, to fail? Is that encoding issue?

Thanks!

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you share your events?

0 Karma

ilyar
Observer

Hi buddy, unfortunately not, it's sensitive data. I'm sure people had the same problem. I believe it has to do with encoding...

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Can you check what your job inspection said on those rows which contains word lispy?
0 Karma

kennetkline
Path Finder

Sounds like maybe a transforms/props issue.

If you are getting hits with the wildcard, I would believe there is a whitespace issue; (where a leading space or more exists in the  value.



0 Karma

ilyar
Observer

Hi! I tried to search with a numerous amouns of spaces, yet it cannot find the value. Using the wildcard works, however. 
Maybe you have an idea as to how to confirm that?

thanks!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index="main" sourcetype="blabla"
| rex "foo=\"(?<characters>.*)bar\""
| fields characters
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...