This command does not work.
index=grb_test sourcetype=QServiceManagerFormat | source="\\\\netapp4\\Quants\\ST\logs\\dailyTest20151020_152356rhbyvk\\qservicemanager.20151020.log"
This one returns results:
index=grb_test sourcetype=QServiceManagerFormat
| where source="\\\\netapp4\\Quants\\ST\logs\\dailyTest20151020_152356rhbyvk\\qservicemanager.20151020.log"
I cannot figure out a reason why. I've tried all manner of escaping the source field in the first search, but can't get it to work.
I think the only thing that should follow a pipe( | ) is a splunk command, not a field name.
That is why it worked when you placed a command, 'where' in your case.
Your search should simply be:
index=grb_test sourcetype=QServiceManagerFormat source="\\\\netapp4\\Quants\\ST\logs\\dailyTest20151020_152356rhbyvk\\qservicemanager.20151020.log"
Unfortunately, that does't work either; -- the pipe in the first input was actually an artifact of editing.
The query:
index=grb_test sourcetype=QServiceManagerFormat source="\\netapp4\Quants\ST\logs\dailyTest20151020_152356rhbyvk\qservicemanager.20151020.log"
produces zero rows.