Indexed terms are just that...terms. They may look like fields with a :: operator (name::value vs name=value) but they are not fields. They are just explicitly formatted terms in TSIDX and within a given term, spaces are just characters like any other. When processing SPL, however: spaces separate terms the quotes around a list of terms are ignored when searching TSIDX So Splunk is interpreting each of your "non-working" SPL examples as either a search for product_categorization_tier_2::security AND systems or product_categorization_tier_2:: AND security AND systems as follows: product_categorization_tier_2::security systems (2 terms) because spaces separate terms product_categorization_tier_2::"security systems" (3 terms) because when Splunk sees non-escaped quotes it assumes the intention is to begin a new (list of) term(s) even if there is no space and quotes are ignored when searching TSIDX "product_categorization_tier_2::security systems" (2 terms) because quotes are ignored when searching TSIDX product_categorization_tier_2::security* , in the other hand, will match any term beginning with product_categorization_tier_2::security whether or not the remainder of the term contains spaces. To achieve what you are trying to do use TERM(product_categorization_tier_2::security systems) which causes everything in the parentheses to be considered a single term, including the space. ... View more