topic Re: Build filter from inputlookup in Splunk Search

Build filter from inputlookup

hvdtol — Sat, 08 May 2021 11:19:35 GMT

I would kindly need some help for a query i am not able to create.

I have inputlookups as source.
And i want to filter with rows from another inputlookup

Simplified:

| inputlookup errmess_dev.csv
| append [| inputlookup errmess_prod.csv]
| table env,msg

DEV we are running out of cola too much sugar
PROD we are running out of wine better take juice
PROD we are running out of beer not so good

I have another inputlookup which should be used as a filter.
| inputlookup filterlines
| table filter
running out of wine
out of cola

I want to establish this: build the search filter from the inputlookup.
How can i do this? Or is there perhaps a better way?

Any help is appreciated.
Regards

Harry

Re: Build filter from inputlookup

kamlesh_vaghela — Sat, 08 May 2021 11:49:44 GMT

@hvdtol

You can try something like this.

If this reply helps you, an upvote would be appreciated.

Thanks
Kamlesh Vaghela

Re: Build filter from inputlookup

hvdtol — Sat, 08 May 2021 15:12:51 GMT

Yes, thank you (and i) made it work.

For some reason i had to make a change. This was the outcome:

| inputlookup filterlines | eval errmsg="*".filter."*" | format
( ( errmsg="*running out of wine*" AND filter="running out of wine" ) OR ( errmsg="*out of cola*" AND filter="out of cola" ) )

I changed it to:
| inputlookup filterlines | rename filter as errmsg | eval errmsg="*".errmsg."*" | format

Re: Build filter from inputlookup

kamlesh_vaghela — Sat, 08 May 2021 16:28:33 GMT

@hvdtol

If this reply helps you, an upvote would be appreciated.

Re: Build filter from inputlookup

hvdtol — Sun, 09 May 2021 08:30:59 GMT

Thank you, this was helpfull

Regards,

Harry