topic i have 40 use cases to evaluate status or incidents in a log file? What programming approch should i follow, how can i use CASE statement here? in Splunk Search https://community.splunk.com/t5/Splunk-Search/i-have-40-use-cases-to-evaluate-status-or-incidents-in-a-log/m-p/290153#M165033 <P>I have 40 usecases.<BR /> I have 800+ incidents in incident log file <BR /> Every inicident should be evaluated by these 40 usecases, and relative feedback should be added to the report .<BR /> 1 incident can have 1 or more than 1 feedback depending on how many usecases turn out to be true.</P> Mon, 20 Nov 2017 09:02:56 GMT alfiyashaikh 2017-11-20T09:02:56Z i have 40 use cases to evaluate status or incidents in a log file? What programming approch should i follow, how can i use CASE statement here? https://community.splunk.com/t5/Splunk-Search/i-have-40-use-cases-to-evaluate-status-or-incidents-in-a-log/m-p/290153#M165033 <P>I have 40 usecases.<BR /> I have 800+ incidents in incident log file <BR /> Every inicident should be evaluated by these 40 usecases, and relative feedback should be added to the report .<BR /> 1 incident can have 1 or more than 1 feedback depending on how many usecases turn out to be true.</P> Mon, 20 Nov 2017 09:02:56 GMT https://community.splunk.com/t5/Splunk-Search/i-have-40-use-cases-to-evaluate-status-or-incidents-in-a-log/m-p/290153#M165033 alfiyashaikh 2017-11-20T09:02:56Z Re: i have 40 use cases to evaluate status or incidents in a log file? What programming approch should i follow, how can i use CASE statement here? https://community.splunk.com/t5/Splunk-Search/i-have-40-use-cases-to-evaluate-status-or-incidents-in-a-log/m-p/290154#M165034 <P>Hi alfiyashaikh,<BR /> use a lookup to manage all your patterns to search:<BR /> if you have to search a value in a field, use this</P> <PRE><CODE>your_search [ | inputlookup my_patterns.csv | table field ] | ... </CODE></PRE> <P>field name must be the same in search.</P> <P>If instead you have to search a pattern in full text search, use this</P> <PRE><CODE>your_search [ | inputlookup my_patterns.csv | rename field AS query | table query ] | ... </CODE></PRE> <P>I have a lookup with all the patterns to search typed by sourcetype, so I can use all patterns or only the ones with a specific sourcetype</P> <PRE><CODE>your_search [ | inputlookup my_patterns.csv | search sourcetype=my_sourcetype | rename field AS query | table query ] | ... </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Mon, 20 Nov 2017 09:44:55 GMT https://community.splunk.com/t5/Splunk-Search/i-have-40-use-cases-to-evaluate-status-or-incidents-in-a-log/m-p/290154#M165034 gcusello 2017-11-20T09:44:55Z