I could see a lot of discussions on this forum, but none solving my issue.
I have a log with content like this:
field number1: value1, Application Server=running, Database Server=running
When I try these searches: Server="running" works fine, but with 'Application Server'="running" or "Application Server"="running" it's not. How can I filter by value of a field which has a space? I need to have logs with Application Server running (not Database Server running).
When you view the raw events in verbose search mode you should see the field names. What is the field name? If it is just "server" you should consider creating either an EXTRACT or REPORT in the props.conf for that source or sourcetype.