Splunk Search

Why does highlight not highlight? What am I doing wrong?

neiljpeterson
Communicator

This should be dead simple. Obviosuly I am missing something.

host=tcserver1 | highlight ERROR

I just want a pretty color for anywhere the string "error" shows up in the logs as I watch them scroll by. I don't only want to see the events with "error", I need to see all of them, but need to be able to visually pick out the ones WITH error when they happen.

The highlight search command seems really straight forward, I can't imagine what I am missing here... I can use CTRL+F to see that there are plenty of instances of this string, but I get no highlighting using the search command. 😞

Tags (2)
0 Karma

bareisd
Explorer

It would be nice to be able to specify a colour but I'd be happy if anything worked.

I am in "raw" mode.

I have discovered that I can highlight text (as OP wanted) but not fields, for example to "fix" the original example, this would work:

host=tcserver1 | highlight "ERROR"

As it would highlight the text "ERROR" wherever it was found.

kenkenou
Explorer

Maybe you could change the view to "Raw" or "List", the string you highlight will be in yellow.

0 Karma

bareisd
Explorer

I can not get "highlight" or "iconify" to do anything in Splunk 6.3

An example:

index=*someapp* sourcetype=*iis* | highlight c_ip
0 Karma

Richfez
SplunkTrust
SplunkTrust

In my case, a bit of testing shows that the highlight only works on the Events page on the raw data, not on the Statistics page. So, if you are doing any statistics or creating a table the highlighting doesn't seem to apply.

Richfez
SplunkTrust
SplunkTrust

Yes, the word user shows up in yellow highlighting when part of "user=admin". Likewise:

index=_audit action=search | highlight user info fields

Highlights each instance of "user" "info" and "fields".

Sounds like you may have a bug? What exact version of Splunk are you using?

0 Karma

neiljpeterson
Communicator

I am on the events page, looking at the _raw. Nothing fancy.

Try this search:

index=_audit action=search | highlight user

Does that change how "user" or the user field looks in the results? Cause it does nothing for me.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...