# Substring search fails, dunno why

**URL:** <https://community.graylog.org/t/substring-search-fails-dunno-why/37052>\
**Category:** Graylog Central (peer support)\
**Created:** [March 5, 2026, 10:24am UTC](https://community.graylog.org/t/substring-search-fails-dunno-why/37052 "2026-03-05T10:24:15Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![ralfbergs](https://avatars.discourse-cdn.com/v4/letter/r/cab0a1/32.png) [@ralfbergs](https://community.graylog.org/u/ralfbergs)\
**Post date:** [March 5, 2026, 7:45pm UTC](https://community.graylog.org/t/substring-search-fails-dunno-why/37052/3 "2026-03-05T19:45:50Z")

</div>

Many thanks for your response, super helpful. And indeed, this tokenization is very counter-intuitive, at least for newbies who don’t have a clue how it works under the hood.

Actually, I tried using the regexp version, but I didn’t include the wildcards, because usually `/foobar/` is equivalent to `/^.*foobar.*$/`. I didn’t find any info in the docs about the implicit `^` and `$` that seem to be applied, which is why my approach was unsuccessful.

---

_[View the full topic](https://community.graylog.org/t/substring-search-fails-dunno-why/37052)._