Splunk Search

how to get events for exact matched string only in the field value

Meharkant123
New Member

I am searching :

index=web account_domain="INCCORP"

bur getting result which have account_doamain with "INCCORP","INCCOPR.NET", "-", "INCCORP.JIP" and so on(all field which have INCCORP in it)

Is there any query or command which will give events for only "INCCORP"? I would like to exclude remaining.
Much appreciate with your help.

Tags (4)
0 Karma

somesoni2
Revered Legend

I'm not sure if that's true. The index=web account_domain="INCCORP" should give events only with field account_domain has exact, but case in-sensitive, value INCCORP, as you're not using any wildcard here. Can you run following and see if you get just one row with account_domain=INCCORP or multiple rows for variations for it.

index=web account_domain="INCCORP" | stats count by account_domain
0 Karma

Meharkant123
New Member

my query was index=* account_domain="INCCORP"

result was like account_doamain with "INCCORP","INCCOPR.NET", "-",

0 Karma

DalJeanis
Legend

That behavior does not sound right. However, there are several options for making sure. Here are two...

| where (account_domain="INCCORP")

| search match(account_domain,"^INCCORP$")  
0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...