topic Re: search with parameters in Splunk Search

search with parameters

sarit_s — Mon, 08 Jun 2020 17:23:48 GMT

Hello,

I have this query:

index=prod eventtype="csm-messages-dhcpd-lpf-eth0-listening" OR eventtype="csm-messages-dhcpd-lpf-eth0-sending" OR eventtype="csm-messages-dhcpd-send-socket-fallback-net" OR eventtype="csm-messages-dhcpd-write-zero-leases" OR eventtype="csm-messages-dhcpd-eth1-nosubnet-declared"
| transaction maxpause=2s maxspan=2s maxevents=5
| eval Max_time=(duration + _time)
| eval Min_time=(_time)
| table _time,eventcount, eventtype ,Min_time, Max_time,tail_id,kafka_uuid
| foreach eventtype
    [eval flag_eventtype=if(eventcount!=5,"no", "yes")]

now i have a lookup table and i want to set parameters in my query that will be taken from the lookup table.
for example , instead of searching

eventtype="csm-messages-dhcpd-lpf-eth0-listening" OR eventtype="csm-messages-dhcpd-lpf-eth0-sending" OR eventtype="csm-messages-dhcpd-send-socket-fallback-net" OR eventtype="csm-messages-dhcpd-write-zero-leases" OR eventtype="csm-messages-dhcpd-eth1-nosubnet-declared"

i want to take the values of the eventtype from the lookup table

how can i do that ?

thanks

Re: search with parameters

efika — Wed, 03 Jun 2020 14:23:39 GMT

Hi Sarit,

Do a subsearch, get all the lookup values into a Multi Value field (MV) and compare the eventtype in the outer search to this MV.

Re: search with parameters

kamlesh_vaghela — Wed, 03 Jun 2020 14:36:59 GMT

@sarit_s

Try

index=prod [ |inputlookup myLookup | table eventtype] | YOUR REST SEARCH

Re: search with parameters

sarit_s — Wed, 03 Jun 2020 16:49:36 GMT

Hey, thanks for your answer..
my lookup table has 10 different columns that calls UsedRule1...UsedRule10
eventtype should be each one of the UsedRole in the lookup

Re: search with parameters

sarit_s — Wed, 03 Jun 2020 16:50:14 GMT

hi, thanks for your answer...

i know the algorithm, i just don't know how to apply it

Re: search with parameters

efika — Thu, 04 Jun 2020 07:21:41 GMT

The end result of the subsearch should be a table with a column that is named "eventtype" and values that should be what you are searching for.
based on what you are describing you might need to transpose the results of the inputlookup

Re: search with parameters

sarit_s — Thu, 04 Jun 2020 07:46:32 GMT

im not sure i understood what you are saying...

this is how my table looks like :

AlertNameNonUnique AlertNameUnique AlertSevirityNonUnique AlertSevirityUnique UsedRule1 UsedRule10 UsedRule2 UsedRule3 UsedRule4 UsedRule5 UsedRule6 UsedRule7 UsedRule8 UsedRule9

how can i use this values as parameters in my query ?

Re: search with parameters

efika — Thu, 04 Jun 2020 13:59:26 GMT

Re: search with parameters

sarit_s — Tue, 09 Jun 2020 21:35:20 GMT

@efika
thanks, it is working but it is not allowed me to be dynamic.
what if my file will contain more than one row ?
also, not all the values in "row 1" are eventtypes.. how can i use the values from the file as arguments ?