Refine your search:

Hi,

I am trying to highlight only a specific term specified by highlight command like this:

index=* man | highlight from

However, with the search above, "man" and "from" are highlighted. Is there any way to highlight only "from"? (I don't want to highlight "man", which is search result from a search before pipe.)

Thank you!

asked 09 Aug '12, 21:38

melonman's gravatar image

melonman
1.1k2318
accept rate: 52%


2 Answers:

Not really an answer, but I don't think this is easily possible... there is an old question relating to this here (it mentions the CSS method which I don't think is worth it as you will still want to highlight terms).

So I think the answer to your question is "no", unless the "man" term is something that can be extracted as a field (or part of a field) in which case you could modify your search to something like..

index=* yourField=man | highlight from

This would stop the highlighting, as it will be filtering on the fields.

Regards,

MHibbin

link

answered 10 Aug '12, 02:26

MHibbin's gravatar image

MHibbin
3.8k312
accept rate: 31%

edited 10 Aug '12, 02:45

Thank you! This is something I need to do, I understood.

(17 Aug '12, 02:10) melonman

Sure, but its not particularly pretty. Splunk won't highlight any field matches in your search terms, so blah=man will not be highlighted.

A quick and dirty way to do this (I would be more specific on the rex ;) ) is;

* something=morespecific source=blah | rex "(?<my_field>man)" | search my_field=man| highlight from
link

answered 10 Aug '12, 02:46

Drainy's gravatar image

Drainy
8.2k617
accept rate: 24%

Thank you for your post. * I accepted the first one

(17 Aug '12, 02:11) melonman
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×1,640
×326
×8

Asked: 09 Aug '12, 21:38

Seen: 429 times

Last updated: 17 Aug '12, 02:11

Copyright © 2005-2012 Splunk Inc. All rights reserved.