I have a number of events searchable by:
index=main sourcetype="myevents"
All of them show foo field with value bar
When adding that as a filter to my query:
index=main sourcetype="myevents" foo=bar
no results are returned.
If I update above to
index=main sourcetype="myevents" foo="bar*"
I do get results.
Any pointers on how to see the real value of foo?
PS I couldn't print foo as list of characters. The closest I got was
| rex field=foo mode=sed "s/(.)/\1+/g"
which printed
b+a+r+
note the last character seems to 'r'
