Hi SplunkLunk!
When searching over events to match strings contained within them, there is no need to explicitly tell Splunk to check the _raw message, as it will be doing that by default.
For example:
index=n00blab host=n00bserver sourcetype=linux:ubuntu:auth root
This search tells Splunk to bring us back any events that have the explicit fields we asked for AND (any space in your search is treated as an implicit 'AND') contains the literal string "root", anywhere in it.
It is the same as saying:
index=n00blab host=n00bserver sourcetype=linux:ubuntu:auth _raw=*root*
The tricky part when searching _raw= is to remember that if you simply said _raw=root, nothing would match, cause I don't have any raw events that only contain the word 'root'. However, I have plenty of events that CONTAIN the string root, so by adding the asterisks, I turn it into a CONTAINS rather than EQUALS...
I strongly recommend bookmarking the Splunk search reference manual, as even the most seasoned Splunker needs to consult the docs for search syntax and rules, from time to time!
http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/WhatsInThisManual
... View more
