Splunk Search

TERM(): How does it work under the covers ?

bdunstan
Path Finder

Hi,

I have a query which I am not sure why its not working,

Assume I have the following JSON record, which has been extracted at index-time

index: network
sourcetype: devices
record: { "deviceId" : 1234, "hostName": "Router1}

1. index=network sourcetype=devices deviceId=1234 => works as expected

2. index=network TERM(sourcetype::devices) => works as expected
3. index=network TERM(sourcetype::devices) deviceId=1234 => Fails, returns 0 records
4. index=network TERM(sourcetype::devices) earliest=-7d@d => Fails, returns 0 records

5. index=network sourcetype::devices deviceId=1234 => works as expected
6. index=network sourcetype::devices deviceId::1234 => works as expected
7. index=network sourcetype::devices deviceId::1234 earliest=-7d@d => works as expected

The real question is, why do queries 3 and 4 fail, when the others work, especially when I can see that query 2 works and returns the correct data.

What impact does TERM() have in the process flow, such that earliest and = make it fail ?

cheers
-brett

0 Karma

PradReddy
Path Finder

Hi bdunstan,

Can you please run searches (3) and (4) to see how lipsy searches differ in the search.log and then we can narrow down to issue for failures

In general TERM Match whatever is inside the parentheses as a single term in the index, even if it contains characters that are usually recognized as minor segmenters, such as periods or underscores.

Here's some good documentation on this.
https://docs.splunk.com/Documentation/Splunk/6.4.2/Search/UseCASEandTERMtomatchphrases

------

An upvote would be appreciated and Accept Solution if it helps!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...