topic Re: How to attain a list with all the fields in which a certain string appears? in Splunk Search

How to attain a list with all the fields in which a certain string appears?

msolgonza — Thu, 23 May 2019 18:30:54 GMT

For example, given the fields and values:

field1=A123
field2=baba
field3=A123B
field4=bA123

I want a list with the fields which contain the string "A123":

field1
field3
field4

Re: How to attain a list with all the fields in which a certain string appears?

koshyk — Thu, 23 May 2019 19:06:06 GMT

depends on if those fields are present in a single event or in multiple events.
Please put the actual event details

Re: How to attain a list with all the fields in which a certain string appears?

msolgonza — Thu, 23 May 2019 19:13:47 GMT

The fields can be present in multiple events. Eg of events in a csv lookup format, if I wanted to match "A":

field1, field2, field3, field4
A, 0, 0, 0
0, A, 0, 0
0, 0, A, 0
A, A, 0, 0
0, A, A, 0
A, 0, A, 0
A, A, A, 0

Basically, it can be given in any order

Re: How to attain a list with all the fields in which a certain string appears?

koshyk — Thu, 23 May 2019 19:22:00 GMT

ah.ok. So the data above is in csv format? Is the columns limited like field1, 2 , 3 ,4 or is it random?

Re: How to attain a list with all the fields in which a certain string appears?

aguthrie1190 — Wed, 30 Sep 2020 00:39:50 GMT

| makeresults count=4 | streamstats count | eval field1=if(count<3,"A",0) | eval field2=if(count>3,"A",0) | eval field3=if(count==3,"A",0) | eval field4=0
| eval field_list=""
| foreach * [eval  field_list=if(match(<<FIELD>>,"A"),field_list+" "+"<<FIELD>>",field_list)]
| makemv delim=" " field_list
| mvexpand field_list
| dedup field_list
| fields field_list

Make results just makes some data to work with. Then we make an empty field list, that we will append field names to if they match your string. So match(<<FIELD>>,"A") will evaluate as true when the CONTENT of the field matches "A". Then field_list+" "+"<<FIELD>> will append the NAME of the field to field_list. Otherwise the if statement just returns the previous field_list.

After that line it's just some data manipulation. | makemv delim=" " field_list will turn all your space delimited field_list variables into multivalues, mvexpand expands them all to their own event, then dedup gets rid of the duplicates.

Hope that helps!