Splunk Search

Issue with search query

mamulani11
New Member

I have User_Id field in my log. In the user_Id field I have value like john,sonia,ces\ts1,......
Now when i am searching for john & sonia
I am getting the exact answer
But when I am searching for ces/ts1.I am getting no result found.
Can anyone please tell me whats the error. Is that search command doesn't take "\".
Please help......

Tags (1)
0 Karma

the_wolverine
Champion

There are escape characters (particularly with the Windows Event Logs, I have noticed). If you're unsure of the syntax you can always search with a wildcard:

User_Id=*ts1

To the left of your results, you have a list of fields. Click on the User_Id field and select the match for your user "css/ts1". This will return the exact search string needed in the search bar for your reference.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

There appears to be a mix of forward slashes / and backslashes \ going on - make sure you're searching for the right kind.

0 Karma

somesoni2
Revered Legend

If there are special character in the field value, while searching then by value, your need to escape them. E.g. if user_id=ces/ts1 then in search use user_id="ces\/ts1"

0 Karma

kristian_kolb
Ultra Champion

please provide your exact search queries, and a few sample lines of your log file.

Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...