search command to retrieve events from indexes or filter the results of a previous search command in the pipeline. You can retrieve events from your indexes, using keywords, quoted phrases, wildcards, and key/value expressions. The
search command is implied at the beginning of any search. You do not need to specify the
search command at the beginning of your search criteria.
search command is not the first command in the pipeline, the
search command is used to filter the results of the previous command and is referred to as a subsearch. See about subsearches in the Search Manual.
After you retrieve events, you can apply commands to transform, filter, and report on the events. Use the vertical bar "|" , or pipe character, to apply a command to the retrieved events.
- Syntax: <logical-expression> | <time-opts> | <search-modifier> | NOT <logical-expression> | <index-expression> | <comparison-expression> | <logical-expression> [OR] <logical-expression>
- Description: Includes all keywords or key/value pairs used to describe the events to retrieve from the index. Include parenthesis as necessary. Use Boolean expressions, comparison operators, time modifiers, search modifiers, or combinations of expressions for this argument.
Logical expression options
- Syntax: <field><comparison-operator><value>
- Description: Compare a field to a literal value.
- Syntax: "<string>" | <term> | <search-modifier>
- Description: Describe the events you want to retrieve from the index using literal strings and search modifiers.
- Syntax: [<timeformat>] (<time-modifier>)*
- Description: Describe the format of the starttime and endtime terms of the search
Comparison expression options
- Syntax: = | != | < | <= | > | >=
- Description: You can use comparison operators when searching field/value pairs. Comparison expressions with the
equal ( = )or
not equal ( != )operator compare string values. For example, "1" does not match "1.0". Comparison expressions with greater than or less than operators
< > <= >=numerically compare two numbers and lexicographically compare other values.
- Syntax: <string>
- Description: The name of a field.
- Syntax: <literal-value>
- Description: In comparison-expressions, the literal number or string value of a field.
Index expression options
- Syntax: "<string>"
- Description: Specify keywords or quoted phrases to match. When searching for strings and quoted strings (anything that's not a search modifier), Splunk software searches the
_rawfield for the matching events or results.
- Syntax: <sourcetype-specifier> | <host-specifier> | <hosttag-specifier> | <source-specifier> | <savedsplunk-specifier> | <eventtype-specifier> | <eventtypetag-specifier> | <splunk_server-specifier>
- Description: Search for events from specified fields or field tags. For example, search for one or a combination of hosts, sources, source types, saved searches, and event types. Also, search for the field tag, with the format:
- Read more about searching with default fields in the Knowledge Manager manual.
- Read more about using tags and field aliases in the Knowledge Manager manual.
- Syntax: host=<string>
- Description: Search for events from the specified host field.
- Syntax: hosttag=<string>
- Description: Search for events that have hosts that are tagged by the string.
- Syntax: eventtype=<string>
- Description: Search for events that match the specified event type.
- Syntax: eventtypetag=<string>
- Description: Search for events that would match all eventtypes tagged by the string.
- Syntax: savedsearch=<string> | savedsplunk=<string>
- Description: Search for events that would be found by the specified saved search.
- Syntax: source=<string>
- Description: Search for events from the specified source field.
- Syntax: splunk_server=<string>
- Description: Search for events from a specific server. Use "local" to refer to the search head.
For a list of time modifiers, see the topic "Time modifiers for search"
- Syntax: timeformat=<string>
- Description: Set the time format for starttime and endtime terms.
- Default: timeformat=%m/%d/%Y:%H:%M:%S.
- Syntax: starttime=<string> | endtime=<string> | earliest=<time_modifier> | latest=<time_modifier>
- Description: Specify start and end times using relative or absolute time.
Note: You can also use the earliest and latest attributes to specify absolute and relative time ranges for your search. Read more about this time modifier syntax in "About search time ranges" in the Search manual.
- Syntax: starttime=<string>
- Description: Events must be later or equal to this time. Must match
- Syntax: endtime=<string>
- Description: All events must be earlier or equal to this time.
search command is a generating command that enables you to use keywords, phrases, fields, boolean expressions, and comparison expressions to specify exactly which events you want to retrieve from Splunk indexes.
Some examples of search terms are:
- quoted phrases:
- boolean operators:
login NOT (error OR fail)
- field values:
status=404, status!=404, or status>200
See Use the search command to retrieve events in the Search Manual.
Comparing two fields
To compare two fields, do not specify
index=myindex fieldA=fieldB or
index=myindex fieldA!=fieldB with the
search command. When specifying a comparison_expression, the
search command expects a <field> compared with a <value>. The
search command interprets
fieldBas the value, and not as the name of a field.
where command instead.
index=myindex | where fieldA=fieldB
For not equal comparisons, you can specify the criteria in several ways.
index=myindex | where fieldA!=fieldB
index=myindex | where NOT fieldA=fieldB
See Use the search command in the Search Manual.
Quotes and escaping characters
In general, you need quotation marks around phrases and field values that include white spaces, commas, pipes, quotations, and brackets. Quotation marks must be balanced. An opening quotation must be followed by an unescaped closing quotation. For example:
- A search such as
error | stats countwill find the number of events containing the string error.
- A search such as
... | search "error | stats count"would return the raw events containing error, a pipe, stats, and count, in that order.
Additionally, you want to use quotation marks around keywords and phrases if you do not want to search for their default meaning, such as Boolean operators and field/value pairs. For example:
- A search for the keyword AND without meaning the Boolean operator:
- A search for this field/value phrase:
The backslash character (\) is used to escape quotes, pipes, and itself. Backslash escape sequences are still expanded inside quotation marks. For example:
- The sequence \| as part of a search will send a pipe character to the command, instead of having the pipe split between commands.
- The sequence \" will send a literal quotation mark to the command, for example for searching for a literal quotation mark or inserting a literal quotation mark into a field using rex.
- The \\ sequence will be available as a literal backslash in the command.
Unrecognized backslash sequences are not altered:
- For example \s in a search string will be available as \s to the command, because \s is not a known escape sequence.
- However, in the search string \\s will be available as \s to the command, because \\ is a known escape sequence that is converted to \.
Search with TERM()
You can use the TERM() directive to force Splunk software to match whatever is inside the parentheses as a single term in the index. TERM is more useful for cases where the term contains minor segmenters, such as periods and commas, and is bounded by major segmenters, such as spaces or commas. In fact, TERM does not work for terms that are not bounded by major breakers.
Search with CASE()
You can use the CASE() directive to search for terms and field values that are case-sensitive.
Example 1: This example demonstrates key/value pair matching for specific values of source IP (src) and destination IP (dst).
src="10.9.165.*" OR dst="10.9.165.8"
Example 2: This example demonstrates key/value pair matching with boolean and comparison operators. Search for events with code values of either 10 or 29, any host that isn't "localhost", and an
xqp value that is greater than 5.
(code=10 OR code=29) host!="localhost" xqp>5
Example 3: This example demonstrates key/value pair matching with wildcards. Search for events from all the webservers that have an HTTP client or server error status.
host=webserver* (status=4* OR status=5*)
Example 4: This example uses
search later in the pipeline to filter out search results. This search defines a web session using the
transaction command and searches for the user sessions that contain more than three events.
eventtype=web-traffic | transaction clientip startswith="login" endswith="logout" | search eventcount>3
Example 5: Searching with the boolean "NOT" the comparison operator is not the same as using the "!=" comparison. The following search returns returns everything except fieldA="value2", including all other fields.
The following search returns events where
fieldA exists and does not have the value "value2".
If you use a wildcard for the value,
NOT fieldA=* returns events where fieldA is null or undefined, and
fieldA!=* never returns any events.
See Difference between NOT and != in the Search Manual.
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the search command.
This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14