topic Re: How to search if data contain value from the other fields? in Splunk Search

How to search if data contain value from the other fields?

urapaveerapan — Sun, 21 May 2017 14:59:06 GMT

I'm very new in Splunk, I'd like to find the event where the short description contain the "Category" or "Subcategory field. (Example in the the yellow highlight.
Other than the field value, how can I match the related words between the fields?
For example,
"CBM Precast" related to "Truck loading" and "GI"
If the Splunk found "Truck loading" or"GI", it also mean that this event match with "Category" field as well.

Please help!!

Re: How to search if data contain value from the other fields?

gcusello — Mon, 22 May 2017 07:20:46 GMT

Hi urapaveerapan,
you have to create a simple search like the following:
if you want a value that fully matches the Category field

index=your_index sourcetype=your_sourcetype Category="CBM Precast" | ...

if you want a value that partially matches the Category field

index=your_index sourcetype=your_sourcetype Category="*Precast*" | ...

or if you're not sure of the field to use in search

index=your_index sourcetype=your_sourcetype Precast | ...

Beware that the field name is case sensitive, instead field value isn't.

I suggest to follow the search tutorial that you can find at http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchTutorial/WelcometotheSearchTutorial

Bye.
Giuseppe

Re: How to search if data contain value from the other fields?

urapaveerapan — Mon, 22 May 2017 08:04:16 GMT

Dear Giuseppe,

The search item is dynamic. It depend on the value in Category or Subcategory fields. So I cannot fill the extact word in its.
Let say, if it is sql query, it gonna be like
select * from [table_name] where [short description] like '%'||Category||'%' or [short description] like '%'||Subcategory||'%'

Re: How to search if data contain value from the other fields?

gcusello — Mon, 22 May 2017 08:32:29 GMT

Hi urapaveerapan,
you can try to use

Category="*short_description*" OR Subategory="*short_description*"

Or try using the like option (see at http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/ConditionalFunctions)

... | where like(Category, "%short_description%") OR like(Subcategory, "%short_description%")

Obviously this search will be not so quick!

Bye.
Giuseppe