Splunk Search

Unable to search for extracted substring if didn't start+end with word boundary in the string it was extracted from

IgorB
Path Finder

Eaxmple:

Sourcetype "test" contains only one event. The event's _raw is "The quick brown fox jumps over the lazy dog" (without quotes)

props.conf contains:

[test]
EXTRACT-test = ^(?<one>.{9})..(?<two>.{3})

The regex in EXTRACT-test should extract two keys:

1. one="The quick"

2. two="row"

Now, if I try to perform the following search, everything works fine and splunk returns one event, as expected

sourcetype="test" one="The quick"

But if I run the search

sourcetype="test" two="row"

splunk returns no results

However, if I execute the search below, splunk returns the expected event.

sourcetype="test" | search two="row"  

Ideas?

Tags (2)
1 Solution

twinspop
Influencer

I've seen it before and my theory is: Your fist search looks for "row" first, then matches it to a field with "row" as a value. Since "row" doesn't match a whole term in _raw, you get nothing. In the second, field extraction has already happened -- you're dealing with the results. In this case, it will match. Make sense?

View solution in original post

twinspop
Influencer

I've seen it before and my theory is: Your fist search looks for "row" first, then matches it to a field with "row" as a value. Since "row" doesn't match a whole term in _raw, you get nothing. In the second, field extraction has already happened -- you're dealing with the results. In this case, it will match. Make sense?

gkanapathy
Splunk Employee
Splunk Employee

That is correct. Splunk searches for the value first (row), then checks to see if it matches, because it's much more efficient. However, if the value is not indexed because it's not a word (or "token") then it won't be found. You can change this behavior in fields.conf for a particular field (INDEXED_VALUE = false) but this can severely hurt search performance for that field. You could instead search for "*row*", which will be better, and you can abstract this away using a macro.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...