query syntax for searching for "#Success"

[newmember]

Good day,

I am trying to figure out to search for this string "#Success'

If I search for "#Success" I get all strings with 'success' missing the "#"

I tried regex /W+uccess \/W+uccess\

So I would like to query for the "#" and capital "S"


Thanks

[newmember]

I am going to use a GROK statement to filter this into a feild and strip off the "#", a long with the other feilds in the logline.

Code: Select all

...
^#%{WORD:Result}
...

Thanks

[scottwilkerson]

I am going to use a GROK statement to filter this into a feild and strip off the "#", a long with the other feilds in the logline.

Code: Select all

...
^#%{WORD:Result}
...

Thanks

This is likely the best bet because with analyzed fields you aren't able to search for a #