Scenarios:
1) searching email logs for an exact subject so I use quotes
index=mail sourcetype=xemail subject = "exact subject"
2) searching email logs for subjects that contains [blah blah] so I use *
index=mail sourcetype=xemail subject = *blah blah*
But what about * "blah blah"
or * "blah blah" *
or "blah blah" *
?
Can anyone explain the best way to search by "is" or "contains" ?
Thank you
It should be "blah blah" , preferably inside double quotes, for 'contains'. For 'is', subject="Full exact string" shoud work fine.
It should be "blah blah" , preferably inside double quotes, for 'contains'. For 'is', subject="Full exact string" shoud work fine.
Thank you, you are correct, I was just wondering about the * because that works too but I will use your method 🙂