topic Re: Manipulate Token Value and use in search in Splunk Search

Manipulate Token Value and use in search

ekammer1 — Fri, 06 Nov 2020 14:32:15 GMT

Hopefully, I can explain this to where it makes sense. I have a forum where I use a TEXT input to generate a token to search for one jobname in the data. This works perfectly for one jobname. I would like to be able to enter one or many different values. Normally I would use a multi-select, but there are over 65,000 possible jobnames. My JobName text input will generate token "tok_Job_Name", then in the search I have

| search Job_Name="$tok_Job_Name$"

I like to be able to enter one job for example JOBAA, or many JOBAA,JOBBB,JOBCC, etc and have the search return all jobs with the given jobnames. Is there a way to manipulate the token value within the search or create a new token after some regex? My thought was, I could use a simple regex command like

| rex field=$tok_Job_Name$ mode=sed "s/,/*","*/g", then the token would be formatted correctly to us a search IN. Hopefully, this makes sense and someone may be able to offer an idea. Thank you in advance for any and all help is given!

Re: Manipulate Token Value and use in search

richgalloway — Fri, 06 Nov 2020 15:45:01 GMT

Have you tried this?

| search Job_Name IN ($tok_Job_Name$)

Re: Manipulate Token Value and use in search

ekammer1 — Fri, 06 Nov 2020 15:53:41 GMT

This works if the user puts the full job name for each item ie.. JOBAA,JOBB. I would also like to wild card, so I could search for JOBA,JOBBB and get back all jobs that have JOBA in them
Results

JOBAA

JOBAC

JOBAX

JOBBB

I could just instruct the user to add * when not using the full job name. Unless there is a way to manipulate the token adding this dynamically.