From docs link text
However, searching for TERM(127.0.0.1) fails for data that looks like this:
ip=127.0.0.1 - user=admin
This is because the equal symbol ( = ) is a minor breaker, not a major breaker. Additionally, the IP address portion of the event is indexed as: ip, 127, 0, 1, and ip=127.0.0.1. You are looking for 127.0.0.1, which is not an indexed term.
... View more