I am not expert on this but I guess one thing is to run btool and make sure you are getting the settings that you think you are. A few months ago I did a quick test to remove double quotes in order that I could use tstats. props.conf [my_sourcetype]
SEGMENTATION = no_double_quotes segmenters.conf [no_double_quotes]
MAJOR = [ ] < > ( ) { } | ! ; , ' * \n \r \s \t & ? + %21 %26 %2526 %3B %7C %20 %2B %3D -- %2520 %5D %5B %3A %0A %2C %28 %29 Then I could search with tstats where I had myfield="123" | tstats count where index=myindex by PREFIX(myfield=)
... View more