Why does searching by source not work sometimes?

[gbronner_rbc]

This command does not work.

index=grb_test sourcetype=QServiceManagerFormat |  source="\\\\netapp4\\Quants\\ST\logs\\dailyTest20151020_152356rhbyvk\\qservicemanager.20151020.log"

This one returns results:

index=grb_test sourcetype=QServiceManagerFormat 
| where source="\\\\netapp4\\Quants\\ST\logs\\dailyTest20151020_152356rhbyvk\\qservicemanager.20151020.log"

I cannot figure out a reason why. I've tried all manner of escaping the source field in the first search, but can't get it to work.

[abhijitmishra87]

I think the only thing that should follow a pipe( | ) is a splunk command, not a field name.

That is why it worked when you placed a command, 'where' in your case.

Your search should simply be:

index=grb_test sourcetype=QServiceManagerFormat source="\\\\netapp4\\Quants\\ST\logs\\dailyTest20151020_152356rhbyvk\\qservicemanager.20151020.log"

[gbronner_rbc]

Unfortunately, that does't work either; -- the pipe in the first input was actually an artifact of editing.

The query:
index=grb_test sourcetype=QServiceManagerFormat source="\\netapp4\Quants\ST\logs\dailyTest20151020_152356rhbyvk\qservicemanager.20151020.log"

produces zero rows.