topic Re: Is it possible to use match in an initial search execution? in Splunk Search

Is it possible to use match in an initial search execution?

nick405060 — Wed, 05 Jun 2019 23:32:14 GMT

Hey guys

So I would like to have a search select events from myindex based on what the user selects in a multiselect.

One way that I can think to do this is to do:

index=myindex ("some raw string that option1 represents ending in a space " AND match($multiselect$,"option1")) OR ("some raw string that option2 represents not ending in a space" AND match($multiselect$,"option2"))  OR ("some raw string that option3 represents ending in a space " AND match($multiselect$,"option3"))

However this option does not work. You cannot do a match in the initial search execution, as far as I can tell. Is this correct? I tried just index=myindex AND match("asdf","asdf") | head 1 and that doesn't work. I could eval temp="$multiselect$" and then match(temp,"option1") however that is not an elegant solution. I want to search for the strings during the initial search because that time complexity is exponentially better. Also I can't use valuePrefix/delimiter because the searched strings end in a white space per https://answers.splunk.com/answers/750199/how-can-i-include-a-trailing-whitespace-in-a-multi.html

Thoughts?

Re: Is it possible to use match in an initial search execution?

maciep — Wed, 05 Jun 2019 23:48:28 GMT

if i add the space in the simple xml, it seems to honor it? See the valueSuffix below. When i went back to the gui, it kept the space.

<input type="multiselect" token="field1">
  <label>field1</label>
  <choice value="some raw text option1">option 1</choice>
  <choice value="some raw text option 2">option2</choice>
  <prefix>(</prefix>
  <suffix>)</suffix>
  <valuePrefix>"</valuePrefix>
  <valueSuffix> "</valueSuffix>
  <delimiter> OR </delimiter>
</input>

Re: Is it possible to use match in an initial search execution?

nick405060 — Wed, 05 Jun 2019 23:56:20 GMT

but not every value ends in a space. so I can't just add the suffix for all.

Re: Is it possible to use match in an initial search execution?

maciep — Thu, 06 Jun 2019 00:21:06 GMT

ah...rtfm...got it.

Re: Is it possible to use match in an initial search execution?

nick405060 — Thu, 06 Jun 2019 00:40:46 GMT

rtfm? there is zero in documentation about either question

Re: Is it possible to use match in an initial search execution?

maciep — Thu, 06 Jun 2019 00:57:40 GMT

oh sorry, that was a reference to me not reading your question closely ("read the f'ing manual").

how about including the quotes in the values instead of the prefix suffix?

   <input type="multiselect" token="field1">
      <label>field1</label>
      <choice value="&quot;some raw text option &quot;">option 1</choice>
      <choice value="&quot;some raw text option&quot;">option2</choice>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix></valuePrefix>
      <valueSuffix></valueSuffix>
      <delimiter> OR </delimiter>
    </input>

Re: Is it possible to use match in an initial search execution?

nick405060 — Thu, 06 Jun 2019 01:04:28 GMT

o cool. will try tomorrow AM thx!!

Re: Is it possible to use match in an initial search execution?

nick405060 — Mon, 10 Jun 2019 16:23:44 GMT

Still dumps the white space.