Splunk Search

Simple search not working but search for NOT != does work.

KeithH
Path Finder

Hi All,

I hope someone can enlighten me with this seemingly simple problem.

I have this very simple search return 32 rows and showing that all events have a transaction_type value.

KeithH_0-1649388935571.png

If I click on the D highlighted above I would expect it to show me just the 20 D rows but instead I get:

KeithH_1-1649388994612.png

Very weird.

If I change the search to 

 

index=orafin sourcetype=ORAFIN2 NOT transaction_type!=D

 

Then I get what I want:

KeithH_2-1649389196087.png

Can someone please explain what is happening?

Thanks, Keith

 

Labels (1)
0 Karma
1 Solution

KeithH
Path Finder

Hi Vatsal,

Thanks for that.  Your suggestion works.  I would have thought that Splunk would search on the field transaction_type which is extracted at search time as a single character field.  

Does this mean if I want to search on the field value (as opposed to words in the _raw) do I need to extract these at index time?

Thanks

View solution in original post

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@KeithH 

Can you please make sure there is No trailing space in transaction_type fields? Just execute below search and check the transaction_type_len, it should be 1 for value D.

index=orafin sourcetype=ORAFIN2 transaction_type="*"
| eval transaction_type_len = len(transaction_type) | table transaction_type transaction_type_len

 

Thanks
KV

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

KeithH
Path Finder

Hi Kamlesh,

Thanks for the suggestion.  I ran what you sent but it shows the field values as 1 byte long.  

KeithH_0-1649651866044.png

So its not htat.

 

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@KeithH - Splunk is searching "D" in the _raw log (events). But in the event, it's not D as alone and that is the reason it is not working. If this is the case then use the following instead:

index=orafin sourcetype=ORAFIN2 transaction_type="D*"

 

I hope this helps!!!!

KeithH
Path Finder

Hi Vatsal,

Thanks for that.  Your suggestion works.  I would have thought that Splunk would search on the field transaction_type which is extracted at search time as a single character field.  

Does this mean if I want to search on the field value (as opposed to words in the _raw) do I need to extract these at index time?

Thanks

Tags (1)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

You can use index-time extraction if you want better performance.

Just make sure your search syntax will be something like the below:

index=orafin sourcetype=ORAFIN2 indexed_transaction_type::D

 

-----
If this was helpful, an upvote would be appreciated!!!

0 Karma

KeithH
Path Finder

Oh - I am running Enterprise version 8.2.4

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...