topic Re: How to generate a search for an exact word pattern? in Splunk Search

How to generate a search for an exact word pattern?

danielcmarcosjr — Wed, 02 Nov 2016 13:44:56 GMT

Hi All,

I want to search a word in Splunk in a certain field for example "foo" and will return the following:

foo bar
only foo bar
only foo

and will not return:

foos
xfoo

Re: How to generate a search for an exact word pattern?

gokadroid — Wed, 02 Nov 2016 15:40:34 GMT

Did you try *foo*, as that shall return foos and xfoo in events.

Updating as per comment, to search exactly "foo", try (foo) as a search term including the round brackets

Re: How to generate a search for an exact word pattern?

danielcmarcosjr — Wed, 02 Nov 2016 15:45:15 GMT

Hi,

Thanks for your reply but it should not display that way.
It should be:

foo bar
only foo bar
only foo

Re: How to generate a search for an exact word pattern?

somesoni2 — Wed, 02 Nov 2016 15:55:32 GMT

Give this a try (run anywhere search, replace everything before the where clause with your search, also replace the field1 with your field name)

| gentimes start=-1 | eval field1="foo bar#only foo bar#only foo#not foos#foox no#don't fool me" | table field1 | makemv field1 delim="#" | mvexpand field1 
| where match(field1,"(\s|^)foo(\s|$)")

Re: How to generate a search for an exact word pattern?

danielcmarcosjr — Wed, 02 Nov 2016 16:06:40 GMT

Hello,

Thank you for your reply however are there any syntax that I can use instead of hardcoding the "foo bar" ....
because the value is from text box.

Re: How to generate a search for an exact word pattern?

gokadroid — Wed, 02 Nov 2016 16:08:08 GMT

that should be easy, try (foo) in search term so that it only searches whole word "foo", nothing more or less.

Re: How to generate a search for an exact word pattern?

somesoni2 — Wed, 02 Nov 2016 16:15:26 GMT

The value of textbox should be assigned to a token, just replace the foo in match function with that token, like this

your base search  | where match(field1,"(\s|^)$yourtextboxToken$(\s|$)")

Re: How to generate a search for an exact word pattern?

danielcmarcosjr — Wed, 02 Nov 2016 16:15:38 GMT

Hi,

I need to search in specific field.
like this
I believe it will return an error
field1=(foo)

Re: How to generate a search for an exact word pattern?

gokadroid — Wed, 02 Nov 2016 16:29:59 GMT

Try regex to your rescue

your search to return field1
| regex field1=".*\sfoo\s.*"
| complete your search

Re: How to generate a search for an exact word pattern?

danielcmarcosjr — Wed, 02 Nov 2016 16:31:01 GMT

hmm. but I believe it will not return result "only foo" because there are no spaces after foo.

Re: How to generate a search for an exact word pattern?

danielcmarcosjr — Wed, 02 Nov 2016 16:34:37 GMT

thanks. but it will not return result if the foo is the last word.

Re: How to generate a search for an exact word pattern?

somesoni2 — Wed, 02 Nov 2016 16:48:29 GMT

Have you tested it? (I provided a runanywhere query with sample data).

Re: How to generate a search for an exact word pattern?

gokadroid — Wed, 02 Nov 2016 16:51:28 GMT

🙂 wow...

your search to return field1
 | regex field1="(.*(^|\s)foo(\s|\n).*)"
 | complete your search

see this please

Re: How to generate a search for an exact word pattern?

danielcmarcosjr — Wed, 02 Nov 2016 16:53:51 GMT

ow yes. it works. What if I have many textboxtoken that are in OR logical operator?

Re: How to generate a search for an exact word pattern?

ddrillic — Wed, 02 Nov 2016 16:54:29 GMT

@somesoni2 - isn't there an exact phrase syntax such as "only foo"? you would expect it from a search engine...

Re: How to generate a search for an exact word pattern?

somesoni2 — Wed, 02 Nov 2016 16:55:54 GMT

Then you'll create match-expression for each of the token.

your base search  | where match(field1,"(\s|^)$yourtextboxToken1$(\s|$)") OR match(field1,"(\s|^)$yourtextboxToken2$(\s|$)") OR ....

Re: How to generate a search for an exact word pattern?

somesoni2 — Wed, 02 Nov 2016 16:57:06 GMT

@Ddrillic, not sure I understood your question?

Re: How to generate a search for an exact word pattern?

danielcmarcosjr — Wed, 02 Nov 2016 17:09:51 GMT

Hi,

What if it should be case insensitive?

Re: How to generate a search for an exact word pattern?

inventsekar — Wed, 02 Nov 2016 17:14:57 GMT

Maybe, regex will help.

Your base search | regex "(\s|^)foo(\s|$)" 
Or
Your base search | regex "\bfoo\b"

Re: How to generate a search for an exact word pattern?

DMohn — Wed, 02 Nov 2016 17:18:54 GMT

Add a (?i) at the start of the regex:

your base search  | where match(field1,"(?i)(\s|^)$yourtextboxToken1$(\s|$)") OR match(field1,"(?i)(\s|^)$yourtextboxToken2$(\s|$)") OR ....