If I understand correctly what's going on, you're getting your events as (almost exclusively) metadata - indexed fields. That's not very good on several levels. Firstly, as you've just noticed, you have difficulty searching for your data. Splunk works the way it does for a reason. If you wanted to have structured data only, you might not have bothered with Splunk at all. But there's more to it. When you're getting indexed fields, they are not getting tokenized - they are stored as a key::value token. They are not searchable with typical Splunk matching rules. You can try using TERM() for partial match as @bowesmana showed but this is far from optimal. You could try using Edge Processor to rewrite such events on Splunk's side so that the raw event contains the actual data.
... View more