Splunk Search

how to get events for exact matched string only in the field value

Meharkant123
New Member

I am searching :

index=web account_domain="INCCORP"

bur getting result which have account_doamain with "INCCORP","INCCOPR.NET", "-", "INCCORP.JIP" and so on(all field which have INCCORP in it)

Is there any query or command which will give events for only "INCCORP"? I would like to exclude remaining.
Much appreciate with your help.

Tags (4)
0 Karma

somesoni2
Revered Legend

I'm not sure if that's true. The index=web account_domain="INCCORP" should give events only with field account_domain has exact, but case in-sensitive, value INCCORP, as you're not using any wildcard here. Can you run following and see if you get just one row with account_domain=INCCORP or multiple rows for variations for it.

index=web account_domain="INCCORP" | stats count by account_domain
0 Karma

Meharkant123
New Member

my query was index=* account_domain="INCCORP"

result was like account_doamain with "INCCORP","INCCOPR.NET", "-",

0 Karma

DalJeanis
Legend

That behavior does not sound right. However, there are several options for making sure. Here are two...

| where (account_domain="INCCORP")

| search match(account_domain,"^INCCORP$")  
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...