I am trying to highlight only a specific term specified by highlight command like this:
However, with the search above, "man" and "from" are highlighted. Is there any way to highlight only "from"? (I don't want to highlight "man", which is search result from a search before pipe.)
asked 09 Aug '12, 21:38
Not really an answer, but I don't think this is easily possible... there is an old question relating to this here (it mentions the CSS method which I don't think is worth it as you will still want to highlight terms).
So I think the answer to your question is "no", unless the "man" term is something that can be extracted as a field (or part of a field) in which case you could modify your search to something like..
This would stop the highlighting, as it will be filtering on the fields.
Sure, but its not particularly pretty. Splunk won't highlight any field matches in your search terms, so blah=man will not be highlighted.
A quick and dirty way to do this (I would be more specific on the rex ;) ) is;
answered 10 Aug '12, 02:46