Great questions. Let me clarify them: How is the field my_field actually extracted? It is extracted via a regex in transforms.conf, and it can be "a sentence like this". Segmentation is set to inner for the source. Are there actually spaces delimiting both sides of text2search (and blah) in all cases? Not in terms of my example; I meant for "text2search" to mean exactly a word. Is text2search actually just a word without internal spaces or punctuation? Yes. Does the search work if you don't specify my_field but just search for text2search (or *text2search or whatever)? Not exactly. It seems for a past 24 hour search I get the same result for *text2search, text2search, text2search*, text2search. Are you running these searches from the Splunk GUI? Yes, tried that to verify against programmatic searches, which have the same results ... View more