Why is my search not specifying field vs _raw or explicit field?

[blardy]

Hello,

I'm trying to understand the behavior of a basic query as the one below (I've ingested a JSON dataset):

index=main syswow64

This will return me many events as I got events with a field path with a value of  c:\windows\syswow64\ws2_32.dll.

Reading the documentation, I understood that not specifying a field will actually query the _raw field, so my first guess was that the above query is equivalent to

index=main _raw=syswow64

 However the above does not return any event as opposed to 

index=main _raw=*syswow64*

So I then thought that it was actually adding wildcards by default to perform the search on the _raw field, however the below seems to indicate that it does not:

# This will not return any event
index=main yswow64
# This will return events
index=main _raw=*yswow64*

So it looks like when not specifying any fields, I can actually search for "words", but I cannot when specifying a field name (ie. _raw= or path=). I'm not sure to understand the concept behind this. Can someone please explain the Splunk behavior and why is this happening?

Also, which is the query that is the most optimized to search the existence of syswow64 for path between the two

index=main syswow64 # this might return more events if syswow64 word is existing in another field
index=main path=*syswow64*

Thank you!

[isoutamo]

Hi

this is interesting question and the real answer will be quite long 😞 So you'll have to settle for a short answer.

Shortly _raw is just an another field just like any other as host, source, sourcetype, index, name etc. Then only difference is that it contains all data what particular event have. Of course there are some other fields (like index, sourcetype etc.) which are not part of _raw even those are part of event's metadata.

When you are searching 

index=main _raw=syswow64

splunk's search engine try to found events which _raw (whole event) is only "syswow64". When you are searching like

index=main _raw=*syswow64*

 then splunk is searching events which contains syswow64 and can have something else or not. This is equal to  your search 

index=main syswow64

 I couldn't see any reason why you want to use _raw=something when you are doing your searches!

Here is some documents which could open this somehow?

• https://conf.splunk.com/files/2016/slides/behind-the-magnifying-glass-how-search-works.pdf
• https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial/Startsearching
• https://conf.splunk.com/watch/conf-online.html?search=Martin%20M%C3%BCller (Speaker Martin Müller and/or Clara Merriman)
• https://conf.splunk.com/watch/conf-online.html?search=Master%20joinin%20datasets (speaker Nick Mealy)

r. Ismo

[gcusello]

Hi @blardy,

running a query like your first one,

index=main syswow64

you perform a ful text search on the _raw events.

You don't need to explicit the _raw field or the asterisks.

Obviously this search is slower than a search on a field, so if you know the field to use for the search you can use this field: so if the field containing the path you showed is "field1, you can run

index=main field1="C:\windows\syswow64*"

that' faster than the previous.

Ciao.

Giuseppe