topic Re: Search for multiple values in field in Splunk Search

Search for multiple values in field

banzen — Wed, 21 Mar 2018 22:23:17 GMT

Hi,
I am trying to omit search results for a field that might have a couple of different values.
any ideas how to best do this? Is EVAL or LIKE the way to go?

Here's some sample data:
computerdisconnected="[bob sbr] [tube tue]"
computerdisconnected="[tube tue]"

condition-
If the computerdisconnected contains any values like "bob or "Tube" then don't return any results.

In other words I am getting regular reminders that these machines are disconnected, I only want NEW results so I want to keep a list of repeat offenders and ignore them.

Thanks in advance

Re: Search for multiple values in field

elliotproebstel — Thu, 22 Mar 2018 01:03:32 GMT

Do all the potential values for computerdisconnected get formatted like that? If so, this might work:

your base search NOT "[bob*" OR "[tube*"

So that's literally whatever you're searching for right now followed immediately by NOT "[bob*" OR "[tube*". The opening square brackets matter, I believe.

Re: Search for multiple values in field

niketn — Thu, 22 Mar 2018 06:10:28 GMT

Agree with @elliotproebstel and to add on I would move such patterns to lookup file

<YourBaseSearch> NOT
    [| inputookup <yourLookupFileName>.csv 
     | eval <yourLookupFiledName>="*".<yourLookupFiledName>."*"
    | rename <yourLookupFiledName> as search]
| <yourRemainingSearch>

Following is a sample search based on the data that you have provided (PS: makeresults used instead of inputlookup to mock up the terms to be filtered from search.

<YourBaseSearch> NOT
    [| makeresults
    | eval lookupData="bob,tube"
    | makemv lookupData delim=","
    | mvexpand lookupData
    | eval lookupData="*".lookupData."*"
    | rename lookupData as search]
| <yourRemainingSearch>

Re: Search for multiple values in field

banzen — Tue, 29 Sep 2020 18:38:00 GMT

And if my list continues to grow, just keep adding OR statements? OR " " OR "" OR "" ? I can do do this, just thought there was a cleaner way, like anything
LIKE or IN ("bob*,"tube*", "next*")

Re: Search for multiple values in field

elliotproebstel — Thu, 22 Mar 2018 20:33:09 GMT

If your list is going to grow, you'd be very smart to follow @niketnilay's advice and set up a lookup table. His search structure will handle the formatting, too.