Splunk Search

String validation not working in splunk like String validation with Arthimetic operator & where is not working

marellasunil
Communicator

If I am trying to match string in where like ..| where server=server108 is not generating result.
Tried, server==server108, server=="server108" even tried where like(server,"server108").

Same issue with string match in veal condition with arthimetic operatores (esp not equal to), not generating correct result.
like ..| chart count(eval(server=server108 AND Service!="serviceA")) ..
Above search is also not generating result, but I can see these in logs...

Really string search in splunk creating headaches, not working properly, Can somebody suggest me.

Tags (4)
0 Karma

sideview
SplunkTrust
SplunkTrust

One thing that will help, is to know that the where command works a little differently from the search command. If you mean to compare field values to literal values in where, you have to quote them explicitly.

For example, | where server=server108 says get me just the rows where the value of the server field is equal to the value of the server108 field, which isn't what you want here.

On the other hand | where server="server108" says get me the rows where the value of the server field is "server108".

In the search command of course, the two expressions, server=server108 vs server="server108" would have the same behavior.

However it sounds like something else is going on. Are you sure that that exact value for that field is present in your events?

Do you perhaps get results for (server="*server108" OR server="server108*")

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...