topic Re: How can I include queried text string in a table output? in Splunk Search

How can I include queried text string in a table output?

SplunkLunk — Mon, 19 Dec 2016 15:24:29 GMT

Greetings,

I'm search my Linux hosts for when the local firewall starts/stops. So I'm using the query:

index= host=* source=/var/log/messages "Starting IPv4 firewall with iptables" (or Stopping when Applicable)

How can I create a table column that displays the text "Starting IPv4 . . . ". I'd like to add that to the table with the time and host name. The first two are easy. However, since the text isn't a field I can add that. Can anyone provide any suggestions or help? Thanks.

Re: How can I include queried text string in a table output?

arkadyz1 — Mon, 19 Dec 2016 16:27:56 GMT

Something like:

| eval searched_text=if(match(_raw,"Starting"),"Starting",if(match(_raw,"Stopping"),"Stopping",""))

assuming you don't have events which match both "Starting..." and "Stopping...".

This is good if you have just a few possible search terms, but may get ugly quickly. You can also have series of eval each creating (or not creating) a different field and then coalesce them into one.

Hope I gave you enough ideas 🙂

Re: How can I include queried text string in a table output?

niketn — Mon, 19 Dec 2016 18:36:15 GMT

You can create your own search time field extraction for Starting IPv4 firewall with iptables and Stopping IPv4 firewall with iptables as Status = Starting or Status=Stopping.

You can do the same through rex, erex or interactive field extraction in Splunk during search time through Extract new fields. You can also do the same through props.conf.

Would it be possible for your to share couple of example events?

Re: How can I include queried text string in a table output?

woodcock — Thu, 06 Apr 2017 14:39:26 GMT

Like this:

index= host=* source=/var/log/messages "Starting IPv4 firewall with iptables" OR "Stopping when Applicable"
| eval IPv4_Firewall_with_iptables=if(searchmatch("Starting IPv4 firewall with iptables"), "Starting ", "Stopping")
| table _time IPv4_Firewall_with_iptables