Filter for messages that contains text with quotation marks

[raculim]

Hi, 

I'm having a hard time trying to narrow down my search results. 

I would like to return only the results that contain the following string on the message: "progress":"COMPLETED","subtopics":"COMPLETED"

The text must be all together, in the sequence above. 

I tried to add a string like the one below in my search but it didn't work:

message="*\"progress\":\"COMPLETED\",\"subtopics\":\"COMPLETED\"*"

Does anyone have suggestions on how to do that? 

I appreciate any help you can provide.

[inventsekar]

Hi @raculim .. @PickleRick 's suggestion works fine, tested (9.3.0)

[isoutamo · Accepted solution]

Hi

one thing what you should do is to check how events are in raw data. Probably the easiest way is check it via "Event Actions -> Show Source".  

In that way you will see how it really is. After that you know (especially with json) are there any space or other character which you need to take care on your strings.

r. Ismo

[raculim]

Thanks @isoutamo . 

The raw data contains some backslashes already: 

\"TOPIC_COMPLETION\"

So I had to perform my seach like this:

index="..." "08:29:41.630" AND \\\"TOPIC_COMPLETION\\\"

Now it's working properly. 

[raculim]

Hi @PickleRick 

First of all, thanks for the reply. 

Let me try to give you a more concrete example:

1. One search example that returns a single result (this works as expected)

2. Adding the TOPIC_COMPLETION string to the search (this works as expected)

3. Adding the "TOPIC_COMPLETION" string to the search (this doesn't return any results. I was expecting the same results as in 1 and 2)

Version 9.2.2406.107

[PickleRick]

Try enclosing your search term with quotes.

"\"TOPIC_COMPLETION\""

[PickleRick]

Seems to work for me.

9.3.0