GRAYLOG - Chapter 2, Exercise 1 Solution
==========================================================
Zero Results from a Separator Mismatch

PROBLEM
-------
A ticket mentions account "bullhorn_31200" but a query for
account:bullhorn-31200 returns zero results. Using this chapter's own
material, explain the most likely cause and how you'd confirm it.

SOLUTION
--------
This chapter established that account is an exact-match field, and that
the real, actual separator between the two parts of an account value can
genuinely vary - some values use an underscore (bullhorn_27515), others
use a hyphen (bullhorn-27515). Guessing the wrong one doesn't produce a
partial match; it silently returns zero results.

The ticket itself already gives the real value: "bullhorn_31200", with
an UNDERSCORE. The query used a HYPHEN instead (bullhorn-31200) - a
separator mismatch, exactly the gotcha this chapter warned about.

ANSWER: The most likely cause is a separator mismatch - the real account
value uses an underscore (bullhorn_31200), but the query used a hyphen
(bullhorn-31200) instead, and account is an exact-match field. To
confirm, re-run the query using the exact separator given in the ticket:

    account:bullhorn_31200

----
WHY THIS WORKS AS AN ANSWER

This is a direct application of the chapter's own real warning: never
assume which separator an account value uses - confirm the real value
rather than guessing. The ticket text itself was the real, available
source of truth here, and matching it exactly (rather than "correcting"
it to a different, assumed format) is exactly the discipline this
chapter's own warn-box called for.