Splunk Search

Unable to search for extracted substring if didn't start+end with word boundary in the string it was extracted from

IgorB
Path Finder

Eaxmple:

Sourcetype "test" contains only one event. The event's _raw is "The quick brown fox jumps over the lazy dog" (without quotes)

props.conf contains:

[test]
EXTRACT-test = ^(?<one>.{9})..(?<two>.{3})

The regex in EXTRACT-test should extract two keys:

1. one="The quick"

2. two="row"

Now, if I try to perform the following search, everything works fine and splunk returns one event, as expected

sourcetype="test" one="The quick"

But if I run the search

sourcetype="test" two="row"

splunk returns no results

However, if I execute the search below, splunk returns the expected event.

sourcetype="test" | search two="row"  

Ideas?

Tags (2)
1 Solution

twinspop
Influencer

I've seen it before and my theory is: Your fist search looks for "row" first, then matches it to a field with "row" as a value. Since "row" doesn't match a whole term in _raw, you get nothing. In the second, field extraction has already happened -- you're dealing with the results. In this case, it will match. Make sense?

View solution in original post

twinspop
Influencer

I've seen it before and my theory is: Your fist search looks for "row" first, then matches it to a field with "row" as a value. Since "row" doesn't match a whole term in _raw, you get nothing. In the second, field extraction has already happened -- you're dealing with the results. In this case, it will match. Make sense?

gkanapathy
Splunk Employee
Splunk Employee

That is correct. Splunk searches for the value first (row), then checks to see if it matches, because it's much more efficient. However, if the value is not indexed because it's not a word (or "token") then it won't be found. You can change this behavior in fields.conf for a particular field (INDEXED_VALUE = false) but this can severely hurt search performance for that field. You could instead search for "*row*", which will be better, and you can abstract this away using a macro.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...