TERM(): How does it work under the covers ?

[bdunstan]

Hi,

I have a query which I am not sure why its not working,

Assume I have the following JSON record, which has been extracted at index-time

index: network
sourcetype: devices
record: { "deviceId" : 1234, "hostName": "Router1}

1. index=network sourcetype=devices deviceId=1234 => works as expected

2. index=network TERM(sourcetype::devices) => works as expected
3. index=network TERM(sourcetype::devices) deviceId=1234 => Fails, returns 0 records
4. index=network TERM(sourcetype::devices) earliest=-7d@d => Fails, returns 0 records

5. index=network sourcetype::devices deviceId=1234 => works as expected
6. index=network sourcetype::devices deviceId::1234 => works as expected
7. index=network sourcetype::devices deviceId::1234 earliest=-7d@d => works as expected

The real question is, why do queries 3 and 4 fail, when the others work, especially when I can see that query 2 works and returns the correct data.

What impact does TERM() have in the process flow, such that earliest and = make it fail ?

cheers
-brett

[PradReddy]

Hi bdunstan,

Can you please run searches (3) and (4) to see how lipsy searches differ in the search.log and then we can narrow down to issue for failures

In general TERM Match whatever is inside the parentheses as a single term in the index, even if it contains characters that are usually recognized as minor segmenters, such as periods or underscores.

Here's some good documentation on this.
https://docs.splunk.com/Documentation/Splunk/6.4.2/Search/UseCASEandTERMtomatchphrases

------

An upvote would be appreciated and Accept Solution if it helps!