topic Re: Iterate search over multiple field values in Splunk Search

Iterate search over multiple field values

Sam1 — Mon, 29 Jun 2020 03:56:31 GMT

Hi,

I've created a search which is based on 1 field value but I need the search to run over many field values. Rather than many repeating lines.

What is the best way to do this? I know what the field values are before the search too.

It will be an alert where if 1 or more field values match the end criteria, an email is sent. I only want 1 email, not 1 for every field value.

Thanks!

Re: Iterate search over multiple field values

anilchaithu — Mon, 29 Jun 2020 04:11:30 GMT

@Sam1

you can use filed= value1 OR filed=value2 and so on in the search. You can always configure the alert to send an email for each result OR group of results.

Re: Iterate search over multiple field values

Sam1 — Mon, 29 Jun 2020 05:21:57 GMT

To give some more detail of my search, it takes the field value and look at the past hour of data, compares that to the past week of data to get the percent difference. Then show result where diff > x.

This needs to done for each field value though and I don't know how to do that without a lot of evals, addtotals, etc. I want to be able to do a nice clean short search regardless of the field value, and pass in the field value.

Thanks.