Splunk Search

How to restrict a search to match a full word?

zsimic
Path Finder

How to search for a whole word? I try searching for something like "something", but I get matches for many things starting with "something" and followed by an underscore character '_', such as: "something_else", "something_other" etc.

I would like to match only "something" (without any underscore after it)

Tags (1)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

I think this has to do with event segmentation - Splunk is tokenizing "something_else" into "something" and "else". http://www.splunk.com/base/Documentation/4.2.1/admin/Configuresegmentationtomanagediskusage

I'm not sure you would want to configure Splunk to defeat this behavior at index time, as it restricts your flexibility in what you can search for. If it is always "something_something" then you can do a search like:

something NOT "something_*"

Which should filter out the "something_else" and "something_other"

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

I think this has to do with event segmentation - Splunk is tokenizing "something_else" into "something" and "else". http://www.splunk.com/base/Documentation/4.2.1/admin/Configuresegmentationtomanagediskusage

I'm not sure you would want to configure Splunk to defeat this behavior at index time, as it restricts your flexibility in what you can search for. If it is always "something_something" then you can do a search like:

something NOT "something_*"

Which should filter out the "something_else" and "something_other"

zsimic
Path Finder

OK, this works well. The logs where this appear consider '_' to be a character just as any other, so tokenizing it there is odd. But this is a very acceptable solution.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...