What is the best way to search email subjects by "is" or "contains"?

[packet_hunter]

Scenarios:

1) searching email logs for an exact subject so I use quotes

index=mail sourcetype=xemail subject = "exact subject"

2) searching email logs for subjects that contains [blah blah] so I use *

index=mail sourcetype=xemail subject = *blah blah*

But what about * "blah blah" or * "blah blah" * or "blah blah" * ?

Can anyone explain the best way to search by "is" or "contains" ?

Thank you

[somesoni2 · Accepted solution]

It should be "blah blah" , preferably inside double quotes, for 'contains'. For 'is', subject="Full exact string" shoud work fine.

[packet_hunter]

Thank you, you are correct, I was just wondering about the * because that works too but I will use your method 🙂