Identfying the Search Terms Matched

[matts1234]

I am trying to search through a data set with a large amount of search terms. This works perfectly using inputlookup tables. The tables allow me to store lots of different terms in a list rather than putting them all in the query. As an example:

index=infrastructure [inputlookup my_search_terms | fields content]

The only problem with this method is that I don't always know what term is matched against the results. Is there a way to display what the result was matched against?

For example, if the term "apache" was matched against in my results, is they a way to find out that the term matched was indeed "apache"?

I appreciate the help in advance.

Cheers,
Matt

[worshamn]

I know this is an old post but I too needed this exact same functionality. Being that none existed I created the matched command app--https://splunkbase.splunk.com/app/3209/. The app supplies just one command - matched - and can be used like so:

* [|inputlookup ransomware_variants|rename variant as search|format]|table _time _raw|matched csv="/opt/splunk/etc/system/lookups/ransomware_variants.csv"

Hopefully it helps someone else out with the same problem.

[Ayn]

No, there is no such functionality. What you could do is use highlight with all the search terms you're using. More info on the highlight command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Highlight

[Ayn]

Did you really post this answer in the correct place? It seems to be kind of unrelated to the question.