Splunk Search

How can I search for an exact match in the raw text of an event?

Path Finder

I currently have a search that kinda works for what I need but it returns a lot of false positives.


Say I have a lookup table file that contains the string "ed" as an entry. Currently when I run the query I get hits on every string that contains "ed" like fred, red, bed, education, etc...

What I would like to do is be able to specify that I only get a hit on an exact match and exclude straings that only contain the string I'm searching for.

Current search:

*[| inputlookup MY_LOOKUP_FILE.csv | rename COLUMN_HEADER as search | fields search | format] | eval rawText= _raw | eval hit=[| inputlookup MY_LOOKUP_FILE.csv | stats values(COLUMN_HEADER) as query | eval query=mvjoin(query,",") | fields query | eval query = "".query.""] | eval hit=split(hit,",") | mvexpand hit | eval hit=lower(hit) | eval rawText=lower(rawText) | where like(rawText,"%"+hit+"%") | TABLE _time,hit,rawText

Any ideas?



Do you have a named field? You can use that for an exact match quite easily.
This example, lets call it approach A does an exact match on path:

host=my_host path=/somepath/ | timechart  span=1m count by path

This while this example, lets call it approach B uses '/somepath/' as a word to do a partial match

host=my_host /somepath/ | timechart  span=1m count by path

Given logs with the following entries for path:


Approach A will only match /somepath/ while approach B will match all three

0 Karma


What delimits the strings you're searching for? If it's a fixed character like comma or space, put it in your like() clause - '... | where like(rawtext,"% "+hit+" %") | ...'. You may need to use multiple like() clauses if the delimiter varies (... | where like(rawtext,"% "+hit+" %") OR like(rawtext,"%,"+hit+",%") | ...).

If this reply helps you, an upvote would be appreciated.
0 Karma

Path Finder

I've tried that with no results.

I've also tried to use
...| where make(rawtext, hit) |... and I get the same results with the false positives.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!