Splunk Search

Unable to search for extracted substring if didn't start+end with word boundary in the string it was extracted from

IgorB
Path Finder

Eaxmple:

Sourcetype "test" contains only one event. The event's _raw is "The quick brown fox jumps over the lazy dog" (without quotes)

props.conf contains:

[test]
EXTRACT-test = ^(?<one>.{9})..(?<two>.{3})

The regex in EXTRACT-test should extract two keys:

1. one="The quick"

2. two="row"

Now, if I try to perform the following search, everything works fine and splunk returns one event, as expected

sourcetype="test" one="The quick"

But if I run the search

sourcetype="test" two="row"

splunk returns no results

However, if I execute the search below, splunk returns the expected event.

sourcetype="test" | search two="row"  

Ideas?

Tags (2)
1 Solution

twinspop
Influencer

I've seen it before and my theory is: Your fist search looks for "row" first, then matches it to a field with "row" as a value. Since "row" doesn't match a whole term in _raw, you get nothing. In the second, field extraction has already happened -- you're dealing with the results. In this case, it will match. Make sense?

View solution in original post

twinspop
Influencer

I've seen it before and my theory is: Your fist search looks for "row" first, then matches it to a field with "row" as a value. Since "row" doesn't match a whole term in _raw, you get nothing. In the second, field extraction has already happened -- you're dealing with the results. In this case, it will match. Make sense?

gkanapathy
Splunk Employee
Splunk Employee

That is correct. Splunk searches for the value first (row), then checks to see if it matches, because it's much more efficient. However, if the value is not indexed because it's not a word (or "token") then it won't be found. You can change this behavior in fields.conf for a particular field (INDEXED_VALUE = false) but this can severely hurt search performance for that field. You could instead search for "*row*", which will be better, and you can abstract this away using a macro.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...