Splunk Search

Searches showing 0 results when using specific text with slashes /'s and -'s in a field?

BrianAyala
Loves-to-Learn

I have a search

index=foobar flashSteamName=foo/bar-moves/12adw320-df21-dasd-124d-12eda234 \

displays 0 results. 

index=foobar flashSteamName=* 

displays results

Now Selected Fields on the left side shows my "flashSteamName".  When I click on it, it shows my values and has a count of 20.  When I click it there it opens a new search and 0 results.  

Also when I have the fields list in table format and I see my field "flashSteamName" and I click the value it shows I have 20 events. When I click it and it opens a search it has 0 results.

Not sure what I can to fix/change or what can be done to be able to click the event data and display the results that states are available.  

Also, I do not have a problem with searches that do not have / or - in the field. 

Labels (2)
0 Karma

The_Simko
Path Finder

That trailing / is catching you.  It's making a delimiter of the next character, instead of being a literal \

Try this:  flashSteamName = "foo/bar-moves/12adw320-df21-dasd-124d-12eda234 \\"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you tried using quotation marks?

 

index=foobar flashSteamName="foo/bar-moves/12adw320-df21-dasd-124d-12eda234"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...