Splunk Search

How to restrict a search to match a full word?

Path Finder

How to search for a whole word? I try searching for something like "something", but I get matches for many things starting with "something" and followed by an underscore character '', such as: "somethingelse", "something_other" etc.

I would like to match only "something" (without any underscore after it)

Tags (1)
1 Solution

SplunkTrust
SplunkTrust

I think this has to do with event segmentation - Splunk is tokenizing "something_else" into "something" and "else". http://www.splunk.com/base/Documentation/4.2.1/admin/Configuresegmentationtomanagediskusage

I'm not sure you would want to configure Splunk to defeat this behavior at index time, as it restricts your flexibility in what you can search for. If it is always "something_something" then you can do a search like:

something NOT "something_*"

Which should filter out the "somethingelse" and "somethingother"

View solution in original post

SplunkTrust
SplunkTrust

I think this has to do with event segmentation - Splunk is tokenizing "something_else" into "something" and "else". http://www.splunk.com/base/Documentation/4.2.1/admin/Configuresegmentationtomanagediskusage

I'm not sure you would want to configure Splunk to defeat this behavior at index time, as it restricts your flexibility in what you can search for. If it is always "something_something" then you can do a search like:

something NOT "something_*"

Which should filter out the "somethingelse" and "somethingother"

View solution in original post

Path Finder

OK, this works well. The logs where this appear consider '_' to be a character just as any other, so tokenizing it there is odd. But this is a very acceptable solution.

0 Karma