i can not search custom field values(with space character) that JSON type data coming from jira app.
for example
customfield1 ="abc abc"
but if I use spath function inside Splunk search I can filtre the customfield value
index=jira
| spath "fields.customfield1"
| search "fields.customfield1"="abc abc"
results found.
index=jira "fields.customfield1"="abc abc"
No results found.
why does the second search is can not find any results ?
how can the second search work correctly ?
It turns out this problem has nothing to with space character, its because of a spacial character that in custom fields value.
It turns out this problem has nothing to with space character, its because of a spacial character that in custom fields value.
Greetings @rarki,
Could you try this? Note the single quotes vs. the double quotes.
index=jira 'fields.customfield1'="abc abc"
Cheers,
Jacob
thats not working also but thank you for the comment @jacobevans