topic Re: Splunk search in Dashboards & Visualizations

Splunk search

SabariRajanT — Fri, 05 Feb 2021 09:54:29 GMT

Hi Team,

I have a dashboard in which there are event date, event title, AD location, Logon location and IP address. I have visualized all the datas into my dashboard.

I my splunk query i need to ignore if AD and Logon location are same. Need to ignore those events getting displayed in dashboard.

Here is the eg:

AD location : Almaty,KZ Logon location: Almaty city, Almaty, KZ. In this case I need to match any of these pair values. Like KZ or Almaty if anything is same. Need to ignore those in my dashboard.

I tried using Like and != operator coudn't able to get the search properly.

Required a quick help.

Thanks,

Re: Splunk search

renjith_nair — Fri, 05 Feb 2021 11:05:37 GMT

If string in ad location is a substring of logic location string, you may try

|where !match(login_location,ad_location)

Here is a run anywhere example. Remove the where condition to see the data and it's comparison

Re: Splunk search

SabariRajanT — Fri, 05 Feb 2021 11:17:39 GMT

@renjith_nair

Thanks for ur response..!!

I prefer to use this:

|where !match(login_location,ad_location)

But this is not ignoring the like search.

Eg: Logon location: Almaty, Almaty City, KZ and AD Location: Almaty, KZ. In this case I want to use a like condition to see atleast KZ matches. So need to ignore these results.

Please suggest if any like condition matches in 2fields that should be ignored.

Re: Splunk search

renjith_nair — Mon, 08 Feb 2021 06:45:57 GMT

Didn't quite get that

Can you make changes to the below dummy search with your inputs and expected output ?