topic Re: Using variables with IN and LIKE functions in Splunk Search

Using variables with IN and LIKE functions

drezanka — Wed, 19 Jan 2022 17:58:27 GMT

I am using Splunk Enterprise V8.2.3.2. I am trying to alert when a scheduled search becomes disabled. The problem is that I have four systems using the same app but with different searches enabled and disabled for each of the systems. I need to dynamically determine which system the alert is running on and get the corresponding list of searches that are supposed to be enabled from a lookup table.

I have done that. Now I need to see if the disabled search name matches one of the search names in the lookup table list. List is like:

Searches that should be enabled(fieldname searches): apple tart,blueberry pie,carrot cake,cupcake

Search found to be disabled(fieldname disabled): carrot cake

I would like to do something like:

eval failed=if(in(disabled,searches),"Failed","Passed")

where disabled in(searches)

or, search disabled IN searches

However, none of these approaches have worked. Any advice? Thanks in advance.

Re: Using variables with IN and LIKE functions

ITWhisperer — Wed, 19 Jan 2022 18:59:01 GMT

Have you tried it the other way around

| eval failed=if(len(disabled)>0 AND match(searches,disabled),"Failed","Passed")

Re: Using variables with IN and LIKE functions

drezanka — Wed, 19 Jan 2022 20:03:58 GMT

It's really a chicken and egg problem. I am trying to use the result of an outer search in an inner search. Working on alternatives.

Re: Using variables with IN and LIKE functions

ITWhisperer — Wed, 19 Jan 2022 21:33:33 GMT

Inner searches are executed before outer searches so this is unlikely to work! Try finding a way to invert the searches

Re: Using variables with IN and LIKE functions

drezanka — Wed, 19 Jan 2022 22:12:14 GMT

I was able to use split() to compare two variables rather than having to have a distinct list defined. Solved