Splunk Search

How to search for strings in secondary search without _raw field available?

frbuser
Path Finder

 

index::my_index host::my_host source::my_source sourcetype::my_sourcetype field1="some value"

| stats list(*) AS * BY field2

| search "string"

 

The above query will fail because the secondary search no longer has the _raw field to search against.

How would you perform a string based search across all available fields in the secondary search without the _raw field?

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What are you trying to achieve? If "string" isn't in your data from the stats, you aren't going to find it. Make sure you have extracted a field which contains "string" before you do the stats.

0 Karma

frbuser
Path Finder

@ITWhispererI am trying to filter out rows that don't contain the "string" being searched for in any of their fields.

My point is that specifying a secondary search like this doesn't work. Your assumption is incorrect. Even if an extracted field contains "string" after that stats command, searching for it using the search command as shown in my example doesn't work. If I specify a specific field it will work but the point is, I'm not always going to know which field to search so I want to search for the "string" across all fields.

The reason it doesn't work is because by default when you use the search command and you don't specify a field, it searches the _raw field for your text. After the stats command, this field no longer exists in the output it seems.

My question is given this scenario, how can I search for "string" in an event list and filter out rows that don't contain the "string" when I don't know which specific field/column may contain the "string".

Test it out your suggestion and see if it works.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How about using eventstats

index::my_index host::my_host source::my_source sourcetype::my_sourcetype field1="some value"
| eventstats list(*) AS * BY field2
| search "string"
| dedup field2
0 Karma
Get Updates on the Splunk Community!

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...