How to restrict a search to match a full word?

[zsimic]

How to search for a whole word? I try searching for something like "something", but I get matches for many things starting with "something" and followed by an underscore character '_', such as: "something_else", "something_other" etc.

I would like to match only "something" (without any underscore after it)

[dwaddle · Accepted solution]

I think this has to do with event segmentation - Splunk is tokenizing "something_else" into "something" and "else". http://www.splunk.com/base/Documentation/4.2.1/admin/Configuresegmentationtomanagediskusage

I'm not sure you would want to configure Splunk to defeat this behavior at index time, as it restricts your flexibility in what you can search for. If it is always "something_something" then you can do a search like:

something NOT "something_*"

Which should filter out the "something_else" and "something_other"

[zsimic]

OK, this works well. The logs where this appear consider '_' to be a character just as any other, so tokenizing it there is odd. But this is a very acceptable solution.