Splunk Search

custom field values with space character

Explorer

i can not search custom field values(with space character) that JSON type data coming from jira app.

for example
customfield1 ="abc abc"

but if I use spath function inside Splunk search I can filtre the customfield value

index=jira
| spath "fields.customfield1"
| search "fields.customfield1"="abc abc"
results found.

index=jira "fields.customfield1"="abc abc"
No results found.

why does the second search is can not find any results ?
how can the second search work correctly ?

0 Karma
1 Solution

Explorer

It turns out this problem has nothing to with space character, its because of a spacial character that in custom fields value.

View solution in original post

0 Karma

Explorer

It turns out this problem has nothing to with space character, its because of a spacial character that in custom fields value.

View solution in original post

0 Karma

Motivator

Greetings @rarki,

Could you try this? Note the single quotes vs. the double quotes.

index=jira 'fields.customfield1'="abc abc"

Cheers,
Jacob

Cheers,
Jacob
0 Karma

Explorer

thats not working also but thank you for the comment @jacobevans

0 Karma