Unable to search for extracted substring if didn't start+end with word boundary in the string it was extracted from

[IgorB]

Eaxmple:

Sourcetype "test" contains only one event. The event's _raw is "The quick brown fox jumps over the lazy dog" (without quotes)

props.conf contains:

[test]
EXTRACT-test = ^(?<one>.{9})..(?<two>.{3})

The regex in EXTRACT-test should extract two keys:

1. one="The quick"

2. two="row"

Now, if I try to perform the following search, everything works fine and splunk returns one event, as expected

sourcetype="test" one="The quick"

But if I run the search

sourcetype="test" two="row"

splunk returns no results

However, if I execute the search below, splunk returns the expected event.

sourcetype="test" | search two="row"  

Ideas?

[twinspop · Accepted solution]

I've seen it before and my theory is: Your fist search looks for "row" first, then matches it to a field with "row" as a value. Since "row" doesn't match a whole term in _raw, you get nothing. In the second, field extraction has already happened -- you're dealing with the results. In this case, it will match. Make sense?

[gkanapathy]

That is correct. Splunk searches for the value first (row), then checks to see if it matches, because it's much more efficient. However, if the value is not indexed because it's not a word (or "token") then it won't be found. You can change this behavior in fields.conf for a particular field (INDEXED_VALUE = false) but this can severely hurt search performance for that field. You could instead search for "*row*", which will be better, and you can abstract this away using a macro.