String validation not working in splunk like String validation with Arthimetic operator & where is not working

[marellasunil]

If I am trying to match string in where like ..| where server=server108 is not generating result.
Tried, server==server108, server=="server108" even tried where like(server,"server108").

Same issue with string match in veal condition with arthimetic operatores (esp not equal to), not generating correct result.
like ..| chart count(eval(server=server108 AND Service!="serviceA")) ..
Above search is also not generating result, but I can see these in logs...

Really string search in splunk creating headaches, not working properly, Can somebody suggest me.

[sideview]

One thing that will help, is to know that the where command works a little differently from the search command. If you mean to compare field values to literal values in where, you have to quote them explicitly.

For example, | where server=server108 says get me just the rows where the value of the server field is equal to the value of the server108 field, which isn't what you want here.

On the other hand | where server="server108" says get me the rows where the value of the server field is "server108".

In the search command of course, the two expressions, server=server108 vs server="server108" would have the same behavior.

However it sounds like something else is going on. Are you sure that that exact value for that field is present in your events?

Do you perhaps get results for (server="*server108" OR server="server108*")