How to combine two of the same type of message string and show table data?

[anirban_nag]

I have one index as foo. In this index there are messages like Bar Baz Hello...., Bar Baz Blah..., Bar Hi.... I want to show the data of the events corresponding with the message which starts with Bar Baz so Bar Hi... will not be shown. I am trying with the following search:

index=foo message="Bar Baz"* | table message _time data

But it is showing nothing. I know I am missing something.

[javiergn · Accepted solution]

There's a typo in your search. Wildcats should go inside the double quotes:

index=foo message="Bar Baz*" | table message _time data