Splunk Search

How can I include queried text string in a table output?

Path Finder


I'm search my Linux hosts for when the local firewall starts/stops. So I'm using the query:

index= host=* source=/var/log/messages "Starting IPv4 firewall with iptables" (or Stopping when Applicable)

How can I create a table column that displays the text "Starting IPv4 . . . ". I'd like to add that to the table with the time and host name. The first two are easy. However, since the text isn't a field I can add that. Can anyone provide any suggestions or help? Thanks.

0 Karma

Esteemed Legend

Like this:

index= host=* source=/var/log/messages "Starting IPv4 firewall with iptables" OR "Stopping when Applicable"
| eval IPv4_Firewall_with_iptables=if(searchmatch("Starting IPv4 firewall with iptables"), "Starting ", "Stopping")
| table _time IPv4_Firewall_with_iptables
0 Karma


You can create your own search time field extraction for Starting IPv4 firewall with iptables and Stopping IPv4 firewall with iptables as Status = Starting or Status=Stopping.

You can do the same through rex, erex or interactive field extraction in Splunk during search time through Extract new fields. You can also do the same through props.conf.

Would it be possible for your to share couple of example events?

| makeresults | eval message= "Happy Splunking!!!"
0 Karma


Something like:

| eval searched_text=if(match(_raw,"Starting"),"Starting",if(match(_raw,"Stopping"),"Stopping",""))

assuming you don't have events which match both "Starting..." and "Stopping...".

This is good if you have just a few possible search terms, but may get ugly quickly. You can also have series of eval each creating (or not creating) a different field and then coalesce them into one.

Hope I gave you enough ideas 🙂

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!