topic How to search two strings and create a message in email body? in Splunk Search

How to search two strings and create a message in email body?

sandeepparcha44 — Fri, 17 Mar 2023 17:33:20 GMT

Hi Team,

I am trying to search <string1> and <String2> from different lines in same log having 100 lines, if both matched i want to show in result with _time, Sring1, String2. Please assist me.

Sample log is like below

... 66 lines omitted ...

Linexx

Linexx ]: "<string1>"

Linexx <string2>

Result should be link

_time , String1

Re: How to search two strings and create a message in email body?

richgalloway — Fri, 17 Mar 2023 17:58:18 GMT

If the 100 lines are all in the same event then a simple AND should do it.

index=foo "string1" "string2" | eval string1="string1" | table _time string1

The result will not be a link, however.

If the 100 lines are in separate events then correlating string1 and string2 requires something common to the two events. What would that be?

Re: How to search two strings and create a message in email body?

sandeepparcha44 — Sat, 18 Mar 2023 04:24:06 GMT

Thank you for reply,

Sorry i missed one thing, Sting 1 is like "*(DC)_String1", when it is showing result it show DC_String1. Is it possible.

Example like AZ_String1 or TX_String1 like this.

Re: How to search two strings and create a message in email body?

yuanliu — Sat, 18 Mar 2023 08:24:24 GMT

It is possible only if you state the problem accurately. Using the same formula as @richgalloway's,

index=foo "*_String1" "string2" | rex "\b(?<dc_string>\w+_String1)\b" | table _time dc_string

Based on your example, the above assumes that this (DC)_String1 is surrounded by word boundaries.

Re: How to search two strings and create a message in email body?

sandeepparcha44 — Sat, 18 Mar 2023 08:50:21 GMT

Example like AZ_String1 or TX_String1 like this.

Re: How to search two strings and create a message in email body?

yuanliu — Sat, 18 Mar 2023 19:04:52 GMT

Then the above rex should give you that.

Re: How to search two strings and create a message in email body?

PickleRick — Sun, 19 Mar 2023 10:08:41 GMT

A side note - remember that searching for terms with a wildcard at the start is very inefficient.