Splunk Search

No results without using wildcard in messagetype in my search

mwinkel
New Member

Hi,
It seems I cannot get any search results without including a wildcard in messagetype.
More specifically:
After searching for messagetype="proposal", no events are shown.
Searching for messagetype="*proposal", events are shown.
Further research also showed that there aren't any special characters involved in the problem.

This is the complete query:

index="*-closecl-*" application="closecl" component="closecl-bfl-ws" 
environment=*
transactionType="notifyParty" messageType="*proposal" | dedup TranID sortby +_time| lookup CloseCLDossierMetaData uid as TranID OUTPUTNEW uid CustomerCode, ProductType, GrossCreditAmount, LabelCode, ProductCode, SourceSystem  | timechart minspan=1d bins=60  dc(TranID) as count | fillnull

Thanks in advance!


updated by dmj to mark code

0 Karma

sbbadri
Motivator

index="-closecl-" application="closecl" component="closecl-bfl-ws" environment=* transactionType="notifyParty" messageType="proposal" | eval messageType=trim(messageType) | rest of your query

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

@sbbadri - be sure to mark your code, please.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Run this and post the results, please...

  index="*-closecl-*" application="closecl" component="closecl-bfl-ws"  environment=*
  transactionType="notifyParty" messageType="*proposal"
 | eval myproposal="---".messageType."---"
 | stats count by myproposal
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Can you share some sample data?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...