All Apps and Add-ons

Why am I getting an unexpected output in Fuzzy Search for Splunk?

mkhalil123
New Member

I ran this search command, but the output shows all domain values.

i expect to get a domain filed that contains value ( google1,google123) only .

I use fuzzy search 2.0.5,splunk-sdk-python-1.6.5 and fuzzywuzzy-master

domain=* |fuzzy wordlist="google" compare_field="domain"
0 Karma

jlanders
Path Finder

Assuming the domain field is not multivalue, the output from the app will contain two main fields:

  • fuzzyout_max_match_ratio
  • fuzzyout_max_match_word

The compare field is split up based on the provided value to option "delims" and each result is measured against the provided wordlist. Key things to keep in mind, particularly for multivalues:

  1. The command does not filter results from the input. If you have a multivalue field, it will measure all values in the field and only show you the highest match.
  2. The command does not produce a list of all matches in a multivalue field or modify your original compare field.

This would probably be a nice feature to have so I'll fit it into the next release. Here are some examples to help highlight command usage.

Example 1:
alt text

Example 2:
alt text

Hope this helps.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...