In each JSON event that I put into Splunk, I have a field with the format:
However, whenever I try to run a search using this field, it always says that there are 0 results, even though I can see plenty of events with this field.
One work around I found was to use spath, and then I was able to search using it, but I'd rather not have to do that every time
Thanks in advance for any help.
Looks like this field is not extracted during index time. And during search time ":" in the field value causing issues. Are you able to filter the data based other fields in the index?