Metasearch and Rawdata is required...

[kryzew]

Hi,

I' cant end my search using metasearch when I need to find in index something with space betwen like "Microsoft Update". There is no problem to find there one word aplikaction like below:

|metasearch index=my_index ("onewordaplikaction")

When I try:

|metasearch index=my_index ("twoword aplikaction")

I get error:

Streamed search execute failed because: Error in 'metalitsearch' command: Invalid metasearch. Rawdata is required for this search..

Is there any way to find by metasearch something like "Microsoft Update" or "Update"? Or is just metasearch limit?

BR,

[woodcock]

You can do it like this:

| tstats count max(_time) AS _time WHERE index="my_index" AND (TERM("onewordaplikaction") OR (TERM("twoword") AND TERM("aplikaction")))

[gcusello]

Hi @kryzew,
with | metasearch you can use only few fields (index, sourcetype, source, host), and you cannot use raw data for text search.
I understand that | metasearch is faster than a normal way, but you cannot use it if you need a text search.
If you don't need other fields, but only raw data, you can use the Fast Search Mode.

Ciao.
Giuseppe

[kryzew]

Hi,
@kamlesh_vaghela
I tired on this way but its don't work.
When I used "Update" or "Microsoft" I can't find field named "Microsoft Update" im metasearch.
I use "*Update" don't work too.

@gcusello I can't explain, but I can find more than splunk doc say about metasearch.

I compare normal search and metasearch, and I have same results, mean time when something hapen.

But, I can't show on table more than fields like index, host, source, sourcetype like splunk doc say.

BR,

[gcusello]

Hi @kryzew,
as I said using metasearch you have only few fields and you cannot use rawdata for text search.

Comparing metasearch and normal search (using Verbose Mode) you have the same number of results only if in your search you're using index, sourcetype, source or host, and anyway with metasearch you haven't the rawdata.
Then you cannot have the same results if you want to use another field or a text search.

Whay do you want to use metasearch? what's your need?

Ciao and Happy New Year.
Giuseppe

[kamlesh_vaghela]

@kryzew

Have you tried these?

|metasearch index=my_index "Microsoft"

OR

|metasearch index=my_index "Update"

OR

|metasearch index=my_index "Microsoft" "Update"