Splunk Search

How to search for strings in secondary search without _raw field available?

frbuser
Path Finder

 

index::my_index host::my_host source::my_source sourcetype::my_sourcetype field1="some value"

| stats list(*) AS * BY field2

| search "string"

 

The above query will fail because the secondary search no longer has the _raw field to search against.

How would you perform a string based search across all available fields in the secondary search without the _raw field?

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What are you trying to achieve? If "string" isn't in your data from the stats, you aren't going to find it. Make sure you have extracted a field which contains "string" before you do the stats.

0 Karma

frbuser
Path Finder

@ITWhispererI am trying to filter out rows that don't contain the "string" being searched for in any of their fields.

My point is that specifying a secondary search like this doesn't work. Your assumption is incorrect. Even if an extracted field contains "string" after that stats command, searching for it using the search command as shown in my example doesn't work. If I specify a specific field it will work but the point is, I'm not always going to know which field to search so I want to search for the "string" across all fields.

The reason it doesn't work is because by default when you use the search command and you don't specify a field, it searches the _raw field for your text. After the stats command, this field no longer exists in the output it seems.

My question is given this scenario, how can I search for "string" in an event list and filter out rows that don't contain the "string" when I don't know which specific field/column may contain the "string".

Test it out your suggestion and see if it works.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How about using eventstats

index::my_index host::my_host source::my_source sourcetype::my_sourcetype field1="some value"
| eventstats list(*) AS * BY field2
| search "string"
| dedup field2
0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...