Splunk Search

Identfying the Search Terms Matched


I am trying to search through a data set with a large amount of search terms. This works perfectly using inputlookup tables. The tables allow me to store lots of different terms in a list rather than putting them all in the query. As an example:

index=infrastructure [inputlookup my_search_terms | fields content]

The only problem with this method is that I don't always know what term is matched against the results. Is there a way to display what the result was matched against?

For example, if the term "apache" was matched against in my results, is they a way to find out that the term matched was indeed "apache"?

I appreciate the help in advance.


Tags (3)


I know this is an old post but I too needed this exact same functionality. Being that none existed I created the matched command app--https://splunkbase.splunk.com/app/3209/. The app supplies just one command - matched - and can be used like so:

* [|inputlookup ransomware_variants|rename variant as search|format]|table _time _raw|matched csv="/opt/splunk/etc/system/lookups/ransomware_variants.csv"

Hopefully it helps someone else out with the same problem.


No, there is no such functionality. What you could do is use highlight with all the search terms you're using. More info on the highlight command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Highlight

0 Karma


Did you really post this answer in the correct place? It seems to be kind of unrelated to the question.