All Apps and Add-ons

Why am I getting an unexpected output in Fuzzy Search for Splunk?

New Member

I ran this search command, but the output shows all domain values.

i expect to get a domain filed that contains value ( google1,google123) only .

I use fuzzy search 2.0.5,splunk-sdk-python-1.6.5 and fuzzywuzzy-master

domain=* |fuzzy wordlist="google" compare_field="domain"
0 Karma

Path Finder

Assuming the domain field is not multivalue, the output from the app will contain two main fields:

  • fuzzyoutmaxmatch_ratio
  • fuzzyoutmaxmatch_word

The compare field is split up based on the provided value to option "delims" and each result is measured against the provided wordlist. Key things to keep in mind, particularly for multivalues:

  1. The command does not filter results from the input. If you have a multivalue field, it will measure all values in the field and only show you the highest match.
  2. The command does not produce a list of all matches in a multivalue field or modify your original compare field.

This would probably be a nice feature to have so I'll fit it into the next release. Here are some examples to help highlight command usage.

Example 1:
alt text

Example 2:
alt text

Hope this helps.

0 Karma