Splunk Search

How can I include queried text string in a table output?

SplunkLunk
Path Finder

Greetings,

I'm search my Linux hosts for when the local firewall starts/stops. So I'm using the query:

index= host=* source=/var/log/messages "Starting IPv4 firewall with iptables" (or Stopping when Applicable)

How can I create a table column that displays the text "Starting IPv4 . . . ". I'd like to add that to the table with the time and host name. The first two are easy. However, since the text isn't a field I can add that. Can anyone provide any suggestions or help? Thanks.

0 Karma

woodcock
Esteemed Legend

Like this:

index= host=* source=/var/log/messages "Starting IPv4 firewall with iptables" OR "Stopping when Applicable"
| eval IPv4_Firewall_with_iptables=if(searchmatch("Starting IPv4 firewall with iptables"), "Starting ", "Stopping")
| table _time IPv4_Firewall_with_iptables
0 Karma

niketn
Legend

You can create your own search time field extraction for Starting IPv4 firewall with iptables and Stopping IPv4 firewall with iptables as Status = Starting or Status=Stopping.

You can do the same through rex, erex or interactive field extraction in Splunk during search time through Extract new fields. You can also do the same through props.conf.

Would it be possible for your to share couple of example events?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

arkadyz1
Builder

Something like:

| eval searched_text=if(match(_raw,"Starting"),"Starting",if(match(_raw,"Stopping"),"Stopping",""))

assuming you don't have events which match both "Starting..." and "Stopping...".

This is good if you have just a few possible search terms, but may get ugly quickly. You can also have series of eval each creating (or not creating) a different field and then coalesce them into one.

Hope I gave you enough ideas 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...