How to search for strings in secondary search without _raw field available?

[frbuser]

index::my_index host::my_host source::my_source sourcetype::my_sourcetype field1="some value"

| stats list(*) AS * BY field2

| search "string"

The above query will fail because the secondary search no longer has the _raw field to search against.

How would you perform a string based search across all available fields in the secondary search without the _raw field?

[ITWhisperer]

What are you trying to achieve? If "string" isn't in your data from the stats, you aren't going to find it. Make sure you have extracted a field which contains "string" before you do the stats.

[frbuser]

@ITWhispererI am trying to filter out rows that don't contain the "string" being searched for in any of their fields.

My point is that specifying a secondary search like this doesn't work. Your assumption is incorrect. Even if an extracted field contains "string" after that stats command, searching for it using the search command as shown in my example doesn't work. If I specify a specific field it will work but the point is, I'm not always going to know which field to search so I want to search for the "string" across all fields.

The reason it doesn't work is because by default when you use the search command and you don't specify a field, it searches the _raw field for your text. After the stats command, this field no longer exists in the output it seems.

My question is given this scenario, how can I search for "string" in an event list and filter out rows that don't contain the "string" when I don't know which specific field/column may contain the "string".

Test it out your suggestion and see if it works.

[ITWhisperer]

How about using eventstats

index::my_index host::my_host source::my_source sourcetype::my_sourcetype field1="some value"
| eventstats list(*) AS * BY field2
| search "string"
| dedup field2