How to handle eval searchmatch with question-mark?

[super_edition]

Hello 

Using the below query, I am trying to build a response

index=my_index openshift_cluster="cluster009" sourcetype=openshift_logs openshift_namespace=my_ns openshift_container_name=container
| search ("POST /myvalue/mytoken/v1?s1=SSO HTTP" OR "POST /myvalue/mytoken/v1?s1=LOYALTY HTTP")
| eval Operations=case(searchmatch("POST /myvalue/mytoken/v1?s1=SSO HTTP"),"type_SSO",searchmatch("POST /myvalue/mytoken/v1?s1=LOYALTY HTTP"),"type_LOYALTY") | stats avg(processDuration) as average perc90(processDuration) as response90 by Operations | eval average=round(average,2),response90=round(response90,2)

Operations	average	response90
type_LOYALTY	212	888
type_SSO	300	442

The above search does not return any table data. I am sure its due to the question-mark character present in in searchmatch and is not being handled as it should be.

Because if I

1) do a plain search, I get the events returned 

| search ("POST /myvalue/mytoken/v1?s1=SSO HTTP" OR "POST /myvalue/mytoken/v1?s1=LOYALTY HTTP")

2) remove by Operations from the query, it returns me the average and response90 value table data

Can someone help me how to handle this.

[yeahnah · Accepted solution]

Hi @super_edition 

It's actually the = that it being interpretted as a kv pair.  Try these options

searchmatch("POST /myvalue/mytoken/v1?s1\=SSO HTTP")

OR

searchmatch("\"POST /myvalue/mytoken/v1?s1=SSO HTTP\"")

 OR

searchmatch(TERM(POST /myvalue/mytoken/v1?s1=SSO HTTP))

 Hope that helps

[super_edition]

Thanks @yeahnah  it worked. 

\=