Splunk Search

Searching for multiple strings within all fields of index

deton0
Explorer

Hi

I'm trying to search for multiple strings within all fields of my index using fieldsummary, e.g.

index=centre_data
| fieldsummary
| search values="*DAN012A Dance*" OR values="*2148 FNT004F Nutrition Technology*"
| table fields

Is there another/better way to perform this search or modify this query so that I can add the field where the "string" appears in the event, as well as include other output fields of my choosing? e.g. User, Date, FieldWhereStringAppears, Object

I have tried a number of things and can't work it out.

Many thanks

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If you put the sought strings in the base search then Splunk will search all fields for them.  Then you can use the fields command to select the fields you want in the output.

index=centre_data ("DAN012A Dance" OR "2148 FNT004F Nutrition Technology")
| fields ...

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

deton0
Explorer

Exactly what I needed, thank you!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you put the sought strings in the base search then Splunk will search all fields for them.  Then you can use the fields command to select the fields you want in the output.

index=centre_data ("DAN012A Dance" OR "2148 FNT004F Nutrition Technology")
| fields ...

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...