topic Re: Why does highlight not highlight? What am I doing wrong? in Splunk Search

Why does highlight not highlight? What am I doing wrong?

neiljpeterson — Tue, 01 Jul 2014 17:00:12 GMT

This should be dead simple. Obviosuly I am missing something.

host=tcserver1 | highlight ERROR

I just want a pretty color for anywhere the string "error" shows up in the logs as I watch them scroll by. I don't only want to see the events with "error", I need to see all of them, but need to be able to visually pick out the ones WITH error when they happen.

The highlight search command seems really straight forward, I can't imagine what I am missing here... I can use CTRL+F to see that there are plenty of instances of this string, but I get no highlighting using the search command. 😞

Re: Why does highlight not highlight? What am I doing wrong?

Richfez — Tue, 01 Jul 2014 18:06:43 GMT

In my case, a bit of testing shows that the highlight only works on the Events page on the raw data, not on the Statistics page. So, if you are doing any statistics or creating a table the highlighting doesn't seem to apply.

Re: Why does highlight not highlight? What am I doing wrong?

neiljpeterson — Wed, 02 Jul 2014 18:01:31 GMT

I am on the events page, looking at the _raw. Nothing fancy.

Try this search:

index=_audit action=search | highlight user

Does that change how "user" or the user field looks in the results? Cause it does nothing for me.

Re: Why does highlight not highlight? What am I doing wrong?

Richfez — Wed, 02 Jul 2014 18:58:10 GMT

Yes, the word user shows up in yellow highlighting when part of "user=admin". Likewise:

index=_audit action=search | highlight user info fields

Highlights each instance of "user" "info" and "fields".

Sounds like you may have a bug? What exact version of Splunk are you using?

Re: Why does highlight not highlight? What am I doing wrong?

bareisd — Wed, 07 Dec 2016 01:46:50 GMT

I can not get "highlight" or "iconify" to do anything in Splunk 6.3

An example:

index=*someapp* sourcetype=*iis* | highlight c_ip

Re: Why does highlight not highlight? What am I doing wrong?

kenkenou — Wed, 07 Dec 2016 02:09:00 GMT

Maybe you could change the view to "Raw" or "List", the string you highlight will be in yellow.

Re: Why does highlight not highlight? What am I doing wrong?

bareisd — Wed, 07 Dec 2016 20:20:02 GMT

It would be nice to be able to specify a colour but I'd be happy if anything worked.

I am in "raw" mode.

I have discovered that I can highlight text (as OP wanted) but not fields, for example to "fix" the original example, this would work:

host=tcserver1 | highlight "ERROR"

As it would highlight the text "ERROR" wherever it was found.