https://community.splunk.com/t5/Getting-Data-In/How-to-customize-what-TERM-can-hit-on/m-p/225857#M98948 <P>Altering what segments can be searched with TERM involves changing the segmenters.conf: <A href="http://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Segmentersconf">http://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Segmentersconf</A></P> <P>Be aware that changes in the characters for major and minor segmenters in the default stanza will have a big effect on ALL data indexed and the disk space required for indexed data. To affect a particular sourcetype, reference it in the stanza name.</P> <P>.. Or to your other question and more simply/safely, you could just create a transforms that indexes a field of interest at index time which could key on an indexed field and would be called from props on a sourcetype basis.</P> Fri, 28 Jul 2017 22:29:19 GMT landen99 2017-07-28T22:29:19Z https://community.splunk.com/t5/Getting-Data-In/How-to-customize-what-TERM-can-hit-on/m-p/225856#M98947 <P>I want to be able to use TERM() on complicated values such as HTTP URLs and user agent strings. Usually, this does not work due to spaces and other breaking characters.</P> <P>Is there a way to customize the terms at all? Hopefully on a sourctype and field basis?</P> <P>If not possible, would other solutions like summary indexing help&gt;</P> Thu, 28 Apr 2016 18:27:20 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-customize-what-TERM-can-hit-on/m-p/225856#M98947 thisissplunk 2016-04-28T18:27:20Z https://community.splunk.com/t5/Getting-Data-In/How-to-customize-what-TERM-can-hit-on/m-p/225857#M98948 <P>Altering what segments can be searched with TERM involves changing the segmenters.conf: <A href="http://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Segmentersconf">http://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Segmentersconf</A></P> <P>Be aware that changes in the characters for major and minor segmenters in the default stanza will have a big effect on ALL data indexed and the disk space required for indexed data. To affect a particular sourcetype, reference it in the stanza name.</P> <P>.. Or to your other question and more simply/safely, you could just create a transforms that indexes a field of interest at index time which could key on an indexed field and would be called from props on a sourcetype basis.</P> Fri, 28 Jul 2017 22:29:19 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-customize-what-TERM-can-hit-on/m-p/225857#M98948 landen99 2017-07-28T22:29:19Z