topic Re: Search term in table results in Splunk Search

Search term in table results

bullbasin — Tue, 29 Oct 2024 18:31:10 GMT

Ok maybe it is too much Splunk today. Whatever it is I can not for the life of me remember how to do this.

I am doing a basic search on some logs. I want to show the search term in the table results. The term is being queried out of the _raw

index=myindex sourcetype=mystuff Environment=thisone "THE_TERM" | top Environment by userid | table Environment, userid

Where and how to I add "THE_TERM" to the table results?

Re: Search term in table results

richgalloway — Wed, 30 Oct 2024 00:07:44 GMT

If the search term is a fixed string then just add it to the table command.

| table Environment, userid, "THE_TERM"

Re: Search term in table results

bullbasin — Wed, 30 Oct 2024 09:39:20 GMT

Unfortunately it is not a fixed term or field. It is just a random term for a search. Similar to using a search in MS Word for "FOO" in a 10,000 page document. Now I am trying to figure out how to make that useful in the table as a result. I have tried an input file this morning but not familiar with working with that.

Table desired....

Environment	userid	option
abc	defgh	THE TERM

Re: Search term in table results

richgalloway — Wed, 30 Oct 2024 12:18:16 GMT

Where does the term come from?

Re: Search term in table results

ITWhisperer — Wed, 30 Oct 2024 12:26:30 GMT

index=myindex sourcetype=mystuff Environment=thisone "THE_TERM" | eval option="THE_TERM"

Re: Search term in table results

bullbasin — Wed, 30 Oct 2024 13:52:03 GMT

The term is being queried out of the _raw. Which is also the field "Log"

Re: Search term in table results

richgalloway — Wed, 30 Oct 2024 15:17:45 GMT

Thank you, but I was wanting to learn where the random text "THE_TERM" comes from and how it gets into the query.