Splunk Search

How do you store the matching value as a field?


Suppose I have a query like:

index=my_index stringA OR stringB OR stringC | table logentry, whatmatched

And for the "whatmatched" field, I would like to have the particular string against my raw data has matched, yielding an output like:

logentry                          | whatmatched
this is message with stringB      | stringB
stringC comes here                | stringC

Is it possible to extract this somehow?

0 Karma


try this

| eval whatmatched = case(like(_raw, "%string1%"), "string1", like(_raw, "%string2%"), "string2", like(_raw, "%string3%"), "string3")
0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...