Splunk Search

Searching for multiple strings within all fields of index

deton0
Explorer

Hi

I'm trying to search for multiple strings within all fields of my index using fieldsummary, e.g.

index=centre_data
| fieldsummary
| search values="*DAN012A Dance*" OR values="*2148 FNT004F Nutrition Technology*"
| table fields

Is there another/better way to perform this search or modify this query so that I can add the field where the "string" appears in the event, as well as include other output fields of my choosing? e.g. User, Date, FieldWhereStringAppears, Object

I have tried a number of things and can't work it out.

Many thanks

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If you put the sought strings in the base search then Splunk will search all fields for them.  Then you can use the fields command to select the fields you want in the output.

index=centre_data ("DAN012A Dance" OR "2148 FNT004F Nutrition Technology")
| fields ...

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

deton0
Explorer

Exactly what I needed, thank you!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you put the sought strings in the base search then Splunk will search all fields for them.  Then you can use the fields command to select the fields you want in the output.

index=centre_data ("DAN012A Dance" OR "2148 FNT004F Nutrition Technology")
| fields ...

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...