how to get events for exact matched string only in the field value

[Meharkant123]

I am searching :

index=web account_domain="INCCORP"

bur getting result which have account_doamain with "INCCORP","INCCOPR.NET", "-", "INCCORP.JIP" and so on(all field which have INCCORP in it)

Is there any query or command which will give events for only "INCCORP"? I would like to exclude remaining.
Much appreciate with your help.

[somesoni2]

I'm not sure if that's true. The index=web account_domain="INCCORP" should give events only with field account_domain has exact, but case in-sensitive, value INCCORP, as you're not using any wildcard here. Can you run following and see if you get just one row with account_domain=INCCORP or multiple rows for variations for it.

index=web account_domain="INCCORP" | stats count by account_domain

[Meharkant123]

my query was index=* account_domain="INCCORP"

result was like account_doamain with "INCCORP","INCCOPR.NET", "-",

[DalJeanis]

That behavior does not sound right. However, there are several options for making sure. Here are two...

| where (account_domain="INCCORP")

| search match(account_domain,"^INCCORP$")