Why is where command not working with Splunk events?

[ghostrider]

I want to search below events in the base search. However these are not getting displayed when I use the where cmd. They are only getting shown when I use the spath and search cmd like below. Any idea why where cmd is not working even though the filter criteria is getting matched? Its working for other events with the same filter criteria belpw. Only difference I can see is the multi line stack_trace field that is missing in other events. Could that be the issue? 


Query that does not give any results even though qualifying events are there

BASE_SEARCH | where like(MOP,"MC")

Query that yields the results

BASE_SEARCH | spath MOP | search MOP=MC

Event

{
LEVEL: ERROR
MESSAGE: Failed to process
stack_trace: Exception trace..
at blah
at blah
MOP: MC
}

[yuanliu · Accepted solution]

The most likely reason is because the JSON object is not extracted if your second search requires an extra spath.  In fact, if you take that spath out in the second, or add that spath in the first, the two should give you the same results