How can I include queried text string in a table output?

[SplunkLunk]

Greetings,

I'm search my Linux hosts for when the local firewall starts/stops. So I'm using the query:

index= host=* source=/var/log/messages "Starting IPv4 firewall with iptables" (or Stopping when Applicable)

How can I create a table column that displays the text "Starting IPv4 . . . ". I'd like to add that to the table with the time and host name. The first two are easy. However, since the text isn't a field I can add that. Can anyone provide any suggestions or help? Thanks.

[woodcock]

Like this:

index= host=* source=/var/log/messages "Starting IPv4 firewall with iptables" OR "Stopping when Applicable"
| eval IPv4_Firewall_with_iptables=if(searchmatch("Starting IPv4 firewall with iptables"), "Starting ", "Stopping")
| table _time IPv4_Firewall_with_iptables

[niketn]

You can create your own search time field extraction for Starting IPv4 firewall with iptables and Stopping IPv4 firewall with iptables as Status = Starting or Status=Stopping.

You can do the same through rex, erex or interactive field extraction in Splunk during search time through Extract new fields. You can also do the same through props.conf.

Would it be possible for your to share couple of example events?

[arkadyz1]

Something like:

| eval searched_text=if(match(_raw,"Starting"),"Starting",if(match(_raw,"Stopping"),"Stopping",""))

assuming you don't have events which match both "Starting..." and "Stopping...".

This is good if you have just a few possible search terms, but may get ugly quickly. You can also have series of eval each creating (or not creating) a different field and then coalesce them into one.

Hope I gave you enough ideas 🙂