Indexed terms are just that...terms. They may look like fields with a :: operator (name::value vs name=value) but they are not fields. They are just explicitly formatted terms in TSIDX and within a given term, spaces are just characters like any other.
When processing SPL, however:
spaces separate terms
the quotes around a list of terms are ignored when searching TSIDX
So Splunk is interpreting each of your "non-working" SPL examples as either a search for
product_categorization_tier_2::security AND systems or product_categorization_tier_2:: AND security AND systems
as follows:
product_categorization_tier_2::security systems (2 terms) because spaces separate terms
product_categorization_tier_2::"security systems" (3 terms) because when Splunk sees non-escaped quotes it assumes the intention is to begin a new (list of) term(s) even if there is no space and quotes are ignored when searching TSIDX
"product_categorization_tier_2::security systems" (2 terms) because quotes are ignored when searching TSIDX
product_categorization_tier_2::security* , in the other hand, will match any term beginning with product_categorization_tier_2::security whether or not the remainder of the term contains spaces.
To achieve what you are trying to do use TERM(product_categorization_tier_2::security systems) which causes everything in the parentheses to be considered a single term, including the space.
... View more
