Splunk Search

Problem with search for field=value

gelica
Communicator

Hi,

When I'm indexing my logs, I extract a field called "file_date" from my source. The field is of the form 2013-07-31_01-05-08.

I have some problems when I want to search for a specific file_date.
Say I want to show all events where file_date = 2013-03-20_21-14-36, and I know that there are 71 events with that value.

If I search for this I get no matching events (I tried qoutes, escaping _ and -)

file_date=2013-03-20_21-14-36

However, if I run a search for whatever before it works. Like this:

* | search file_date=2013-03-20_21-14-36
file_date=* | search file_date=2013-03-20_21-14-36

I have a total of 1525 different events, all with this field, and all of them are from this year (starts with 2013), if I run a search like these

file_date=* 
* | search file_date=2013*

I get 1525 events, but if I search for

file_date=2013*

I only get 72 events.

Does anybody know how to fix this problem?

(In case someone is wondering, the fields are extracted and are showing up in the fields list.
I also have an id field which is extracted in the same way, but only consist of 6 digits, and when I search for that field everything works as normal.)

Tags (2)
0 Karma

sowings
Splunk Employee
Splunk Employee

Try file_date=TERM(2013-03-20_21-14-36). More details here:

http://splunk-base.splunk.com/answers/68584/why-does-my-search-not-find-the-\_

0 Karma

Ayn
Legend
0 Karma

lukejadamec
Super Champion

It is possible that Splunk is not sure whether to treat the values as a number or a string.

Try defining it as a string after the extraction and before the search. See the details here:
http://splunk-base.splunk.com/answers/11131/how-to-typecast-an-integer-as-a-string-literal

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...