topic search matching big multiline string in Splunk Search

search matching big multiline string

722624 — Wed, 15 Mar 2017 14:51:53 GMT

Hello All,
I have a multiline very big string exported from excel CSV file to splunk...it worked good i can see all the values in fields
now if I want to search

index = xxxxxx source = yyyyyyyy field = " below given sample field value"

then I am getting NO RESULT
Do I need any special search methods to be used to match exact string ?????

sample field value is below (PLease note this forum is not showing 100% match of my text when I paste here, but it is 90% match )
The ! (exclamation point) before SSLv2 is what disables this protocol.

Windows
Disable SSLv2 protocol support in Microsoft Windows

Configure the server to require clients to use at least SSLv3 or TLS.

For Microsoft Windows before Windows 2003, see KB187498 (http://support.microsoft.com/kb/187498) . For newer versions of Microsoft Windows, see KB245030 (http://support.microsoft.com/kb/245030) .
Disable insecure TLS/SSL protocol support

Configure the server to require clients to use TLS version 1.2 using Authenticated Encryption with Associated Data (AEAD) capable ciphers.

Re: search matching big multiline string

niketn — Wed, 15 Mar 2017 15:24:21 GMT

@722624... Have you tried escaping special characters in your search string with backslash \?
Also use TERM() for defining exact term for search.

https://docs.splunk.com/Documentation/Splunk/latest/Search/UseCASEandTERMtomatchphrases

Re: search matching big multiline string

woodcock — Wed, 15 Mar 2017 16:28:42 GMT

The problem is that your field starts with a space, which is a segmenter.

I won't try to explain the nuance but try calling out each word of the match string like this:

index = xxxxxx source = yyyyyyyy below given sample field value field=" below given sample field value"

Try bookending your search string with asterisks like this:

index = xxxxxx source = yyyyyyyy field="*below given sample field value*"

or:

index = xxxxxx source = yyyyyyyy below given sample field value field=" below given sample field value"

Re: search matching big multiline string

DalJeanis — Wed, 15 Mar 2017 18:15:46 GMT

Yes, field = " blah blah " seems problematic. Wonder if he should be using a field name at all in this case.

Re: search matching big multiline string

722624 — Thu, 16 Mar 2017 05:57:42 GMT

Thank you for the reply....Actaully there is no space in the beginning

when I upload the CSV, the values are stored in a field called "Solution"

now I have to make a drilldown down report, where I am writing the query (This is dynamic, first level is a table with all soutions....after clicking a row of the table , the report goes to further level down, with more details about particular solution)...I am able to show the table ....when a row is clicked , I am trying to get the details of that solution writing something like below....

Solution = "The ! (exclamation point) before SSLv2 is what disables this protocol.

Windows
Disable SSLv2 protocol support in Microsoft Windows

Configure the server to require clients to use at least SSLv3 or TLS.
For Microsoft Windows before Windows 2003, see KB187498 (http://support.microsoft.com/kb/187498) . For newer versions of Microsoft Windows, see KB245030 (http://support.microsoft.com/kb/245030) . "

Re: search matching big multiline string

722624 — Thu, 16 Mar 2017 05:58:07 GMT

Thank you for the reply....Actaully there is no space in the beginning

when I upload the CSV, the values are stored in a field called "Solution"

Solution = "The ! (exclamation point) before SSLv2 is what disables this protocol.

Windows
Disable SSLv2 protocol support in Microsoft Windows

Re: search matching big multiline string

722624 — Thu, 16 Mar 2017 06:00:06 GMT

I tried using TERM but not getting any result

I used like this

TERM(The ! (exclamation point) before SSLv2 is what disables this protocol.

Windows
Disable SSLv2 protocol support in Microsoft Windows