Create a field out of matched search strings

[skippylou]

So trying to figure out if using rex is the best way to do this.

When you search for say "blah one", in the resulting events, the matched text "blah one" is highlighted. I don't actually see any special field made out of this though (maybe there is a default one or something?).

What I'd like to do is for searches that have multiple ORs, like: "blah one" OR "blah two" OR "blah three", have a field called matched_text or something that contains the matched string for each event in the results.

Is using individual rex commands with each search string the best way or am I overlooking something obvious.

Thanks,

scott

[skippylou]

Basically looking to see of the resulting events returned match against which set of search terms. So in the example above, how many events returned match "blah one", etc.

I figured rex was the way to go here, but wasn't sure if part of the process that splunk uses to highlight the matched search terms in the resulting events was exposed somehow.

[gkanapathy]

It might be helpful to know what you ultimately want to do with this field.

[jrodman · Accepted solution]

The highlighting behavior was designed for usability enhancement, whether or not a field existed, it highlights the matching text. You can trigger this behavior manually, if you want, with the |highlight command.

As for creating fields ad-hoc, on pattern matching, rex is the tool to use. |rex (?P<myfield>blah \w+)

[skippylou]

Thanks, rex it is then.