Download topic as PDF
Use CASE() and TERM() to match phrases
If you want to search for a specific term or phrase in your Splunk index, use the CASE() or TERM() directives to do an exact match of the entire term.
- CASE: Search for case-sensitive matches for terms and field values.
- TERM: Match whatever is inside the parentheses as a single term in the index, even if it contains characters that are usually recognized as minor segmenters, such as periods or underscores.
When you search for a term that contains minor segmenters, the term is treated by default as a phrase. The Splunk software searches for the conjunction of the subterms (the terms between minor breakers) and post-filters the results. For example, when you search for the IP address 127.0.0.1, Splunk software searches for: 127 AND 0 AND 1
This search is not very efficient if the conjunction of these subterms is common, even if the whole term itself is not common.
When to use TERM
The TERM directive is useful when you are searching for a term:
- That contains minor breakers, but does not contain major breakers
- Is bound by major breakers, such as spaces or commas
For example, the IP address 127.0.0.1 contains the period ( . ) minor breaker. If you specify TERM(127.0.0.1), the Splunk software treats the IP address as a single term, instead of individual numbers.
The TERM directive only works for terms that are bounded by major or minor breakers. The term you are searching for cannot contain major breakers. For example, you cannot search for Maria Dubois with TERM because there is a space between the names. This is illustrated in the examples below.
When you use the TERM directive, the Splunk software expects to see the term you specify as a token in the lexicon in the .tsidx file. For more information about how Splunk software breaks events up into searchable segments, see About segmentation in Getting Data In.
Examples
Searching for TERM(127.0.0.1) works for raw data that looks like this:
127.0.0.1 - admin
Both 127.0.0.1 and admin are bounded by major breakers, in this case spaces.
However, searching for TERM(127.0.0.1) fails for data that looks like this:
ip=127.0.0.1 - user=admin
This is because the equal symbol ( = ) is a minor breaker, not a major breaker. Additionally, the IP address portion of the event is indexed as: ip, 127, 0, 1, and ip=127.0.0.1. You are looking for 127.0.0.1, which is not an indexed term.
If your data looks like this:
ip 127.0.0.1 - user admin
Searching for TERM(user admin) fails to return results. The space is a major breaker and the phrase "user admin" is not indexed as a single term. In this situation, use quotation marks to search for a string that contains a space, for example "user admin".
See also
- Related information
- Event segmentation and searching
- .conf talks
- Mastering Search Speed
|
PREVIOUS Difference between NOT and != |
NEXT SPL and regular expressions |
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 7.0.1, 7.0.11, 7.0.13
Feedback submitted, thanks!