Splunk Cloud

Search Reference

Download manual as PDF

Download topic as PDF



Highlights specified terms in the events list. Matches a string or list of strings and highlights them in the display in Splunk Web. The matching is not case sensitive.


highlight <string>...

Required arguments

Syntax: <string> ...
Description: A space-separated list of strings to highlight in the results. The list you specify is not case-sensitive. Any combination of uppercase and lowercase letters that match the string are highlighted.


The highlight command is a distributable streaming command. See Command types.

The string that you specify must be a field value. The string cannot be a field name.

You must use the highlight command in a search that keeps the raw events and displays output on the Events tab. You cannot use the highlight command with commands, such as stats which produce calculated or generated results.


Example 1:

Highlight the terms "login" and "logout".

... | highlight login,logout

Example 2:

Highlight the phrase "Access Denied".

... | highlight "access denied"

See also



Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the highlight command.


This documentation applies to the following versions of Splunk Cloud: 6.6.3, 7.0.0, 7.0.2, 7.0.5, 7.0.3, 7.0.8, 7.1.3, 7.1.6, 7.2.3, 7.2.4, 7.2.6, 7.2.7


Is there a way to highlight based on a regex match?

February 15, 2017

Feature Request: Please add support to allow highlighting based on field names.

November 6, 2014

Feature request: Please add support to help specify multiple colors

December 5, 2012

Feature request: Please add support to help specify colors, as well as to remove default highlighting.

October 12, 2012

Feature Request: Please add support for regular expressions, so one can for example highlight an ip address

July 22, 2011

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters