Hi Splunkers,
I've got a strange problem over here: I got events indexed via the http event collector which behave strange when searched for exact field values.
Let's say I got events with a field "domain" with value "example.org". Splunk reports those field/values correctly.
Now, if I search for
domain="example.org"
Splunk returns no events at all. However, if I search for
domain="*example.org*"
Splunk returns all matching events. More funny, if I do
* | eval dd=domain | search dd="example.org"
Splunk returns all matching events.
We do have this effect only on a few fields for this particular http collector stream. Here is an example of the (stripped) payload we send over
{"event":"EventName","fields":{"domain":"example.org"}}
Any ideas?
... View more
