Equals SIgn Not Being Handled For Searches

[mripp]

I recently wiped my server clean of all Splunk files to start fresh with 8.0.3. I am able to forward data from my Windows machine using Sysmon. All sourcetypes show up correctly in Splunk with no issues. The problem arises when I start to search. For any search that includes the equals sign "=", the search returns nothing. For example, EventID = 4104 returns 0 events, but EventID 4104 returns eight events. Is this a new feature? This is happening on every search that requires an equals sign. Any help is appreciated.

[richgalloway · Accepted solution]

It looks like fields are not being extracted from the events. That's why the first search fails to find field 'EventID' with the value '4104', but the second search successfully finds events containing texts 'EventID' and '4104'.

Did you install a Windows TA after you wiped the server?

[mripp]

Thank you for replying. I did install Windows TA after I removed everything referencing Splunk. I may uninstall and try to reinstall Splunk or fall back to an older version.