I am currently working on a log and filtering data. Splunk has identified uri_query as a field. I have come across an event with the uri_query  field "src=../../../../wp-config.php". However, when I try and search uri_query="src=../../../../wp-config.php", Splunk automatically removes "../../../". This shortens the search to uri_query="src=wp-config.php", causing the search to return with no results. Any help to solve the issue of "../../../" being removed would be appreciated!  ... View more