Splunk Search

How to highlight only specific term?

melonman
Motivator

Hi,

I am trying to highlight only a specific term specified by highlight command like this:

index=* man | highlight from

However, with the search above, "man" and "from" are highlighted.
Is there any way to highlight only "from"?
(I don't want to highlight "man", which is search result from a search before pipe.)

Thank you!

Tags (3)
1 Solution

MHibbin
Influencer

Not really an answer, but I don't think this is easily possible... there is an old question relating to this here (it mentions the CSS method which I don't think is worth it as you will still want to highlight terms).

So I think the answer to your question is "no", unless the "man" term is something that can be extracted as a field (or part of a field) in which case you could modify your search to something like..

index=* yourField=man | highlight from

This would stop the highlighting, as it will be filtering on the fields.

Regards,

MHibbin

View solution in original post

0 Karma

Drainy
Champion

Sure, but its not particularly pretty. Splunk won't highlight any field matches in your search terms, so blah=man will not be highlighted.

A quick and dirty way to do this (I would be more specific on the rex 😉 ) is;

* something=morespecific source=blah | rex "(?<my_field>man)" | search my_field=man| highlight from

melonman
Motivator

Thank you for your post.
* I accepted the first one

0 Karma

MHibbin
Influencer

Not really an answer, but I don't think this is easily possible... there is an old question relating to this here (it mentions the CSS method which I don't think is worth it as you will still want to highlight terms).

So I think the answer to your question is "no", unless the "man" term is something that can be extracted as a field (or part of a field) in which case you could modify your search to something like..

index=* yourField=man | highlight from

This would stop the highlighting, as it will be filtering on the fields.

Regards,

MHibbin

0 Karma

melonman
Motivator

Thank you!
This is something I need to do, I understood.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...