https://community.splunk.com/t5/Splunk-Search/string-search/m-p/29828#M177968 <P>with which command do you look for a certain string in search?</P> Thu, 08 Aug 2013 21:23:06 GMT innomius 2013-08-08T21:23:06Z https://community.splunk.com/t5/Splunk-Search/string-search/m-p/29828#M177968 <P>with which command do you look for a certain string in search?</P> Thu, 08 Aug 2013 21:23:06 GMT https://community.splunk.com/t5/Splunk-Search/string-search/m-p/29828#M177968 innomius 2013-08-08T21:23:06Z https://community.splunk.com/t5/Splunk-Search/string-search/m-p/29829#M177969 <P>rex commands see: <A href="http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Rex">http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Rex</A></P> Thu, 08 Aug 2013 21:37:50 GMT https://community.splunk.com/t5/Splunk-Search/string-search/m-p/29829#M177969 cpeteman 2013-08-08T21:37:50Z https://community.splunk.com/t5/Splunk-Search/string-search/m-p/29830#M177970 <P>or if it is only one string not a type of strings just put quotes around it in the search</P> Thu, 08 Aug 2013 21:38:46 GMT https://community.splunk.com/t5/Splunk-Search/string-search/m-p/29830#M177970 cpeteman 2013-08-08T21:38:46Z https://community.splunk.com/t5/Splunk-Search/string-search/m-p/29831#M177971 <P>Hello,<BR /> You can put specific strings with quotes like</P> <PRE><CODE>sourcetype=x "string"|..../sourcetype=x NOT "string"|.... </CODE></PRE> <P>this will give you the events containing/not with the string.</P> <P>Or you can go for match/searchmatch in eval</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/CommonEvalFunctions</A></P> <P>Thanks</P> Thu, 08 Aug 2013 21:49:42 GMT https://community.splunk.com/t5/Splunk-Search/string-search/m-p/29831#M177971 linu1988 2013-08-08T21:49:42Z