string search

[innomius]

with which command do you look for a certain string in search?

[linu1988 · Accepted solution]

Hello,
You can put specific strings with quotes like

sourcetype=x "string"|..../sourcetype=x NOT "string"|....

this will give you the events containing/not with the string.

Or you can go for match/searchmatch in eval

http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/CommonEvalFunctions

Thanks

[cpeteman]

or if it is only one string not a type of strings just put quotes around it in the search

[cpeteman]

rex commands see: http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Rex