We have a large amount of data coming in, and the filename is used to derive some of the fields.
One of the fields is 'cclient', as we can see from the below search, it is extracting the field correctly:
index=bluecoat source=*Fox* earliest=-2w | stats count by cclient cclient count Fox_8 48412
However when searching, something strange happens... even though the data is there, it is returning substantially less than the previous query
index=bluecoat cclient=Fo* earliest=-2w | stats count by cclient cclient count Fox_8 1483
Even less when you go more specific...
index=bluecoat cclient=Fox* earliest=-2w | stats count by cclient cclient count Fox_8 1309
and even less again when you get even more specific...
index=bluecoat cclient=Fox_8 earliest=-2w | stats count by cclient cclient count Fox_8 27
Utilising quotes doesn't change anything. I have also cleared all eventdata from this index to ensure the change of data didn't do anything weird.
It is worth noting that when the string was "Fox 8", there wasn't this problem. I had to change the data to replace the space with an underscore, as tags cannot contain spaces... even when wrapped in quotes.
Has anyone seen this before? Is there a resolution/workaround?
I haven't updated to 4.3 yet...