https://community.splunk.com/t5/Monitoring-Splunk/Quick-and-Dirty-Keyword-Search/m-p/307335#M2862 <P>I know that this can be done with a lookup, but I was wondering if there was a quick and dirty way to search through web traffic for like three keywords. For example:</P> <P>bad1<BR /> bad2<BR /> bad3</P> <P>I would like to break the keywords into counts. Normally you would do count by fieldName. </P> <P>Is there a way to do this in SPL, and not have to create a lookup table for each time you go hunting for something? This would probably be used once or twice per set of keywords - that is why I am not trying to do a saved lookup. </P> Fri, 31 Mar 2017 15:52:30 GMT stakor 2017-03-31T15:52:30Z https://community.splunk.com/t5/Monitoring-Splunk/Quick-and-Dirty-Keyword-Search/m-p/307335#M2862 <P>I know that this can be done with a lookup, but I was wondering if there was a quick and dirty way to search through web traffic for like three keywords. For example:</P> <P>bad1<BR /> bad2<BR /> bad3</P> <P>I would like to break the keywords into counts. Normally you would do count by fieldName. </P> <P>Is there a way to do this in SPL, and not have to create a lookup table for each time you go hunting for something? This would probably be used once or twice per set of keywords - that is why I am not trying to do a saved lookup. </P> Fri, 31 Mar 2017 15:52:30 GMT https://community.splunk.com/t5/Monitoring-Splunk/Quick-and-Dirty-Keyword-Search/m-p/307335#M2862 stakor 2017-03-31T15:52:30Z https://community.splunk.com/t5/Monitoring-Splunk/Quick-and-Dirty-Keyword-Search/m-p/307336#M2863 <P>Try something like this</P> <PRE><CODE>your base search bad1 OR bad2 OR bad3 | eval keyword=case(searchmatch("bad1"),"bad1",searchmatch("bad2"),"bad2",searchmatch("bad3"),"bad3") | stats count by keyword </CODE></PRE> <P>OR</P> <PRE><CODE>your base search bad1 OR bad2 OR bad3 | rex max_match=0 "(?&lt;keyword&gt;(bad1|bad2|bad3)" | stats count by keyword </CODE></PRE> Fri, 31 Mar 2017 16:29:32 GMT https://community.splunk.com/t5/Monitoring-Splunk/Quick-and-Dirty-Keyword-Search/m-p/307336#M2863 somesoni2 2017-03-31T16:29:32Z