Why does highlight not highlight? What am I doing wrong?

[neiljpeterson]

This should be dead simple. Obviosuly I am missing something.

host=tcserver1 | highlight ERROR

I just want a pretty color for anywhere the string "error" shows up in the logs as I watch them scroll by. I don't only want to see the events with "error", I need to see all of them, but need to be able to visually pick out the ones WITH error when they happen.

The highlight search command seems really straight forward, I can't imagine what I am missing here... I can use CTRL+F to see that there are plenty of instances of this string, but I get no highlighting using the search command. 😞

[bareisd]

It would be nice to be able to specify a colour but I'd be happy if anything worked.

I am in "raw" mode.

I have discovered that I can highlight text (as OP wanted) but not fields, for example to "fix" the original example, this would work:

host=tcserver1 | highlight "ERROR"

As it would highlight the text "ERROR" wherever it was found.

[kenkenou]

Maybe you could change the view to "Raw" or "List", the string you highlight will be in yellow.

[bareisd]

I can not get "highlight" or "iconify" to do anything in Splunk 6.3

An example:

index=*someapp* sourcetype=*iis* | highlight c_ip

[Richfez]

In my case, a bit of testing shows that the highlight only works on the Events page on the raw data, not on the Statistics page. So, if you are doing any statistics or creating a table the highlighting doesn't seem to apply.

[Richfez]

Yes, the word user shows up in yellow highlighting when part of "user=admin". Likewise:

index=_audit action=search | highlight user info fields

Highlights each instance of "user" "info" and "fields".

Sounds like you may have a bug? What exact version of Splunk are you using?

[neiljpeterson]

I am on the events page, looking at the _raw. Nothing fancy.

Try this search:

index=_audit action=search | highlight user

Does that change how "user" or the user field looks in the results? Cause it does nothing for me.