topic Re: Query for returning only the matching events? in Splunk Search

Query for returning only the matching events?

dougtoppin — Wed, 24 Dec 2014 14:24:00 GMT

I have been wondering how to query for and return only events that contain my search term (I'm using dashboard panels). Whenever I query now I get a long list of events in the response with the ones that I am interested in and many others that I do not want to see. The query response does highlight the one that I am interested in but surrounds it with a few events before and a couple of hundred other events after from the same time period. This clutters up my panel and wastes display space. I've been checking the documentation but have not seen anything that tells me how to return only the events containing my search term.

Re: Query for returning only the matching events?

jayannah — Wed, 24 Dec 2014 14:34:04 GMT

Can you please elaborate with example? would like to more on what is your search query looks like, the result u see and the result u expect..

Re: Query for returning only the matching events?

dougtoppin — Wed, 24 Dec 2014 15:02:14 GMT

It is a JBoss server log that is being indexed and my search term is: host=myhost "worda:wordb"

The host is the one that the log is being collected from and the events that I want returned contain exactly the text "worda:wordb".

I still do not understand queries in that the above query return almost 300 lines from the server log with the one line that has the above text in it highlighted so it knows what I am looking for. I want the query to return only the line(s) that contain exactly the above text.

Re: Query for returning only the matching events?

jayannah — Wed, 24 Dec 2014 15:29:39 GMT

It looks like you have to fix the line breaking for the input file.

1. whats in your props.conf for this sourcetype?
2. Do you see one line of log as one line event in splunk?
3. Give sample of few log events and the line breaking condition

if you fix line breaking, i think it should work fine.

Re: Query for returning only the matching events?

dougtoppin — Wed, 24 Dec 2014 15:38:52 GMT

tks for your answer. I don't control (and can't even see) the props.conf so I did not realize that it might not be treating line breaks as individual events. I will find out and see if that is what is causing my problems.

Re: Query for returning only the matching events?

jayannah — Wed, 24 Dec 2014 15:42:16 GMT

How many lines of log events you see in one splunk event?

Re: Query for returning only the matching events?

dougtoppin — Wed, 24 Dec 2014 15:53:38 GMT

It looks like 260 lines are in one event. Now I realize that each thing in the response box is an individual event so it makes sense to me. I will find out how it is configured.

Re: Query for returning only the matching events?

jayannah — Wed, 24 Dec 2014 16:04:55 GMT

Good. The event breaking is the root cause. .