I have User_Id field in my log. In the user_Id field I have value like john,sonia,ces\ts1,......
Now when i am searching for john & sonia
I am getting the exact answer
But when I am searching for ces/ts1.I am getting no result found.
Can anyone please tell me whats the error. Is that search command doesn't take "\".
Please help......
There are escape characters (particularly with the Windows Event Logs, I have noticed). If you're unsure of the syntax you can always search with a wildcard:
User_Id=*ts1
To the left of your results, you have a list of fields. Click on the User_Id field and select the match for your user "css/ts1". This will return the exact search string needed in the search bar for your reference.
There appears to be a mix of forward slashes /
and backslashes \
going on - make sure you're searching for the right kind.
If there are special character in the field value, while searching then by value, your need to escape them. E.g. if user_id=ces/ts1 then in search use user_id="ces\/ts1"
please provide your exact search queries, and a few sample lines of your log file.