Splunk Search

How do you search for events that match the exact text of a raw text?

Danielle2018V
New Member

Hello

index="cs_test" "Splunktest" "Refund succeeded" OR *"action"=>"refund"*

I have a below raw text log, I want to return events that contain either "Refund succeeded" OR "action"=>"refund", the problem is logs that contain only " => " or "refund" are also being returned. How do I just return results that contain exact string of "Refund succeeded" OR "action"=>"refund"?

Example raw text

"status"=>"pending", "action"=>"refund", "convert_to_cash_url"=>nil}], "v2_return_service_enabled"=>true, "inventory_service_id"=>"voucher", "order_reversal_url"=>"/order_reversal/refund", "is_expiration_extendable"=>false, "can_partial_refund"=>false, "tradable"=>"ineligible", "merchant_payment_text"=>"Continuous", 

Thanks

0 Karma
1 Solution

rteja9
Path Finder

Try below search,

index="cs_test" "Refund succeeded" OR "\"action\"=>\"refund\""

View solution in original post

0 Karma

j_cabanillas
Explorer

@Danielle2018V

Seems like you are just working with the raw logs, are fields not being extracted ? If not, you can do something like this :

index="cs_test" "Splunktest" | rex field=_raw "action"\S{3}(?<action>[^"]*) | search "Refund succeeded" OR action=refund
I create the field action ,for future references, in case you want to see other actions .
If you can show me a log sample where the value "Refund succeeded" is present we can create another field , your search will be much more accurate

0 Karma

rteja9
Path Finder

Try below search,

index="cs_test" "Refund succeeded" OR "\"action\"=>\"refund\""

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...