Is it possible to include metadata in keyword searches?

[hulahoop]

It is a subtlety of the search language that keyword searches run against the raw event data only. To search metadata fields like host, source, sourcetype, one would use the host=/source=/sourcetype= field modifiers. Is there a toggle to enable keyword searches to execute on metadata?

For example, take the following event:

Wed Mar 3 19:04:51 2010 action=update, path="/etc/hosts", isdir=0, size=236, gid=0, uid=0, modtime="Tue Mar 2 11:51:00 2010", mode="rw-r--r--", hash=, chgs="modtime "

The metadata associated with this event is host=myhost, source=fschangemonitor, sourcetype=fs_notification.

If you wanted to find all the fschange events from this host, you couldn't simply type in myhost in the search bar. You need to use host=myhost.

Is it possible to change the default search behavior so that a search on myhost would find these events?

[jrodman · Accepted solution]

unqualified strings search against the event text.

This probably deserves an exploration of the use case and so on in a support conversation. You don't really want all keywords to always search all indexed fields.

If you wanted to get this result today, you would have to arrange for the event text to contain the hostname.

[hulahoop]

Or it would be nice if we could specify which metadata fields are searchable along with event text. For this use case it would be just host.