Ok maybe it is too much Splunk today. Whatever it is I can not for the life of me remember how to do this.
I am doing a basic search on some logs. I want to show the search term in the table results. The term is being queried out of the _raw
index=myindex sourcetype=mystuff Environment=thisone "THE_TERM"
| top Environment by userid
| table Environment, userid
Where and how to I add "THE_TERM" to the table results?
index=myindex sourcetype=mystuff Environment=thisone "THE_TERM"
| eval option="THE_TERM"
index=myindex sourcetype=mystuff Environment=thisone "THE_TERM"
| eval option="THE_TERM"
If the search term is a fixed string then just add it to the table command.
| table Environment, userid, "THE_TERM"
Unfortunately it is not a fixed term or field. It is just a random term for a search. Similar to using a search in MS Word for "FOO" in a 10,000 page document. Now I am trying to figure out how to make that useful in the table as a result. I have tried an input file this morning but not familiar with working with that.
Table desired....
Environment | userid | option |
abc | defgh | THE TERM |
Where does the term come from?
The term is being queried out of the _raw. Which is also the field "Log"
Thank you, but I was wanting to learn where the random text "THE_TERM" comes from and how it gets into the query.