Unable to search based on certain fields

[sidthesloth98]

In each JSON event that I put into Splunk, I have a field with the format:

"field": "1:2:3:4"
However, whenever I try to run a search using this field, it always says that there are 0 results, even though I can see plenty of events with this field.

One work around I found was to use spath, and then I was able to search using it, but I'd rather not have to do that every time

Thanks in advance for any help.

[manjunathmeti]

Are you seeing values for the "field" in your base index search? Is this field extracted in index?

[sidthesloth98]

Yeah, I can see these values in the events, just not when I try to search on a certain value. It's not extracted in index

[manjunathmeti]

Looks like this field is not extracted during index time. And during search time ":" in the field value causing issues. Are you able to filter the data based other fields in the index?

[sidthesloth98]

I can search with all other fields in the index, its just this one that I have problems with

[manjunathmeti]

Then this field is not extracted during index-time. Try and check:
index= | search field="1:2:3:4" OR index= | where field="1:2:3:4"

[to4kawa]

I see, Can you provide samples?

[codebuilder]

Are the other fields displayed that you expect to be extracted?

[to4kawa]

check this
Extract fields from files with structureddata

[richgalloway]

spath is the command for parsing json data. What is your objection to using it?

[sidthesloth98]

It just feels messy to me, I don't see why I would have to use it if the data is already there when indexing