Help with search query

avneet26 — Tue, 02 Aug 2022 15:01:01 GMT

i have a list of string lets say "abc" "bcd" "def" "efg" "fgh".

I want to search each of these string against a query for example :

"abc"

index=xyz sourcetype=logs host=localhost | table _time, _raw

and i want to search it as - if this string occurs in the result-set within last 10 days then it should print "present" otherwise it should print "absent"

Re: search query

isoutamo — Tue, 02 Aug 2022 07:56:28 GMT

if you have only small number of strings which you are looking, then you can try this

index=xyz sourcetype=logs host=localhost earliest=-10d@d | rex "(?<foo1>string1)" ..... ```Add all strings here one by one``` | rex "(?<fooN>stringN)" | stats values(foo*) as foo* | fillnull value=NULL foo1 ... fooN ```here you must named all variables``` | foreach foo* [eval present_<<FIELD>> = if ('<<FIELD>>' == "NULL", "absent", "present")] | table foo* present*

r. Ismo

topic Re: search query in Getting Data In

Help with search query

Re: search query