Splunk Search

Equals SIgn Not Being Handled For Searches

mripp
New Member

alt textI recently wiped my server clean of all Splunk files to start fresh with 8.0.3. I am able to forward data from my Windows machine using Sysmon. All sourcetypes show up correctly in Splunk with no issues. The problem arises when I start to search. For any search that includes the equals sign "=", the search returns nothing. For example, EventID = 4104 returns 0 events, but EventID 4104 returns eight events. Is this a new feature? This is happening on every search that requires an equals sign. Any help is appreciated.
alt text

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It looks like fields are not being extracted from the events. That's why the first search fails to find field 'EventID' with the value '4104', but the second search successfully finds events containing texts 'EventID' and '4104'.

Did you install a Windows TA after you wiped the server?

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It looks like fields are not being extracted from the events. That's why the first search fails to find field 'EventID' with the value '4104', but the second search successfully finds events containing texts 'EventID' and '4104'.

Did you install a Windows TA after you wiped the server?

---
If this reply helps you, Karma would be appreciated.
0 Karma

mripp
New Member

Thank you for replying. I did install Windows TA after I removed everything referencing Splunk. I may uninstall and try to reinstall Splunk or fall back to an older version.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...