Field matches not working properly

Comments

3 comments

  • Avatar
    Rick Jury

    hi Azriel,

    this seems a bit strange for sure. using matches the string is case sensitive so that is one thing to check. your filter would not match S822 for example.

    if you have parsed out the host field in a field extraction rule you will get better performance in the query using host=uv1s* instead, and doing this as a wild-carded keyword it's case insensitive as well, for example:

    _sourcecategory=something host=uv1s* | ... more query

    one other thing to check is in a matching query add something like this just to check if there is say a trailing space in the host value:

    | concat("'",host,"'") as check_host
    | count by check_host

    0
    Comment actions Permalink
  • Avatar
    Azriel Nguyen

    the host field is in a field extraction rule.  I've tested and verified that the host is not including trailing spaces.  It is strange that when I do a query for uv1s822:  The display field on left panel does not show.  It does however show for uv2s822:, this is very strange since we've used this for over a year now and never had this issue.  I'll attach some screenshots to show the display field thing.

    uv1s822:

    uv2s822:

    query for uv*:

    0
    Comment actions Permalink
  • Avatar
    Azriel Nguyen

    when I do the wildcard search other hosts with "uv" shows up, I'm thinking something is probably wrong with the uv1s8222 server.  Thanks for your help Rick.  Our guy have been doing some restores on that server so I'm not sure, but I don't think any more time on this will yield anything useful.

    0
    Comment actions Permalink

Please sign in to leave a comment.