I am searching :
index=web account_domain="INCCORP"
bur getting result which have account_doamain with "INCCORP","INCCOPR.NET", "-", "INCCORP.JIP" and so on(all field which have INCCORP in it)
Is there any query or command which will give events for only "INCCORP"? I would like to exclude remaining.
Much appreciate with your help.
I'm not sure if that's true. The index=web account_domain="INCCORP"
should give events only with field account_domain has exact, but case in-sensitive, value INCCORP
, as you're not using any wildcard here. Can you run following and see if you get just one row with account_domain=INCCORP or multiple rows for variations for it.
index=web account_domain="INCCORP" | stats count by account_domain
my query was index=* account_domain="INCCORP"
result was like account_doamain with "INCCORP","INCCOPR.NET", "-",
That behavior does not sound right. However, there are several options for making sure. Here are two...
| where (account_domain="INCCORP")
| search match(account_domain,"^INCCORP$")