topic Re: How to get word on search and save on new column tables ? in Splunk Enterprise Security

How to get word on search and save on new column tables ?

nisnes12 — Thu, 27 Jun 2019 09:20:02 GMT

Hello guys,

I have a search,

sourcetype=example "testword" OR "abcd" |  table _time _raw

If I run this query, I get some result because triggered on the testword or abcd (string). My question, how do I find the word that causes the result to appear and that word I display in the table column?

Example:

table
_raw : abcd is the only alphabet
word : abcd
_time : 18:00

_raw : this only testword
word : testword
_time : 18:00

Please help me, create a value of column word from a word on a search, thanks.

Re: How to get word on search and save on new column tables ?

renjith_nair — Thu, 27 Jun 2019 10:56:40 GMT

@nisnes12 ,

Not sure about the use case but it's always better to extract the field and do the comparison. Regardless of that, if you want to find the string matching the event, try this

|eval word_matched=if(searchmatch("abcd"),"abcd","testword")

Re: How to get word on search and save on new column tables ?

nisnes12 — Fri, 28 Jun 2019 03:36:10 GMT

thanks for your answers, but how to i have many string in the query ? example i have 100 string for condition

Re: How to get word on search and save on new column tables ?

niketn — Fri, 28 Jun 2019 03:48:16 GMT

@nisnes12 in your SPL while filtering data for index do you filter 100 words? Or one or two of 100 values? How do you apply filter? Can you share your current SPL and elaborate your issue?

Re: How to get word on search and save on new column tables ?

nisnes12 — Fri, 28 Jun 2019 03:51:17 GMT

sourcetype=example "testword" OR "abcd" OR "test" OR "ball" OR "happy" (and many more) | table _time _raw

i think good to use case command for this issue, what about you ?

Re: How to get word on search and save on new column tables ?

renjith_nair — Fri, 28 Jun 2019 12:38:49 GMT

@nisnes12, you can use case as well if there are multiple values. However if you have a specific pattern or field where these strings appear, then it would be more efficient and easy. What's your use case and final result you want to achieve?

Re: How to get word on search and save on new column tables ?

nisnes12 — Wed, 03 Jul 2019 09:14:02 GMT

yes use case function, how about my word is regex words ? example sourcetype=example "testword" OR "abcd" | eval word=case(match(_raw,"(delmitier)*abc"),"abcd") | table _time _raw
, if i use case , i get error 'Error in 'eval' command: Regex: quantifier does not follow a repeatable item'

Re: How to get word on search and save on new column tables ?

FrankVl — Wed, 03 Jul 2019 10:42:41 GMT

This feels like a very cumbersome approach to achieve something that might be achieved much more easily in other ways. But without any understanding of the actual data and the end goal that you want to achieve, that is a bit difficult to provide any concrete suggestions.