All;
I am running Splunk 6.3.5 and need to see what term "hits" in the resulting event. The search is:
index=proxysg sourcetype=proxysg_base [|inputlookup aterms.csv | return 10000 $aterms]
I attempted to use `index=proxysg sourcetype=proxysg_base [|inputlookup aterms.csv | return 10000 $aterms] |highlight $aterms`
with no luck.
Is this possible? I have seen this done automatically in 6.5. without the `|highlight`
Many thanks.
↧