Splunk Search

Create a field out of matched search strings

skippylou
Communicator

So trying to figure out if using rex is the best way to do this.

When you search for say "blah one", in the resulting events, the matched text "blah one" is highlighted. I don't actually see any special field made out of this though (maybe there is a default one or something?).

What I'd like to do is for searches that have multiple ORs, like: "blah one" OR "blah two" OR "blah three", have a field called matched_text or something that contains the matched string for each event in the results.

Is using individual rex commands with each search string the best way or am I overlooking something obvious.

Thanks,

scott

Tags (2)
0 Karma
1 Solution

jrodman
Splunk Employee
Splunk Employee

The highlighting behavior was designed for usability enhancement, whether or not a field existed, it highlights the matching text. You can trigger this behavior manually, if you want, with the |highlight command.

As for creating fields ad-hoc, on pattern matching, rex is the tool to use. |rex (?P<myfield>blah \w+)

View solution in original post

skippylou
Communicator

Basically looking to see of the resulting events returned match against which set of search terms. So in the example above, how many events returned match "blah one", etc.

I figured rex was the way to go here, but wasn't sure if part of the process that splunk uses to highlight the matched search terms in the resulting events was exposed somehow.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

It might be helpful to know what you ultimately want to do with this field.

0 Karma

jrodman
Splunk Employee
Splunk Employee

The highlighting behavior was designed for usability enhancement, whether or not a field existed, it highlights the matching text. You can trigger this behavior manually, if you want, with the |highlight command.

As for creating fields ad-hoc, on pattern matching, rex is the tool to use. |rex (?P<myfield>blah \w+)

skippylou
Communicator

Thanks, rex it is then.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...