search help against lookup values

[mcbradford]

eventtype=bluecoat [| inputlookup wfap_lookup | where wfap_priority=2 | fields wfap_indicator | rename wfap_indicator as search| format "" "(" "OR" ")" "OR" ""] user="test"

The lookup will contain values such as:

string priority

car 0
"red car" 2
"blue car" 1
red 3

The problem I am having is with the multi-string values. For example, if I am looking for "red car", the search above will find within an event red and car, but not always as the string "red car". The event might have someting like, "Red is a nice color. A fast car is fun to drive".

[alacercogitatus]

I would agree with Ayn, but when I ran it, the search didn't have the quotes around "red car". I added this: | eval search = "\"" .search."\"" | before the format and it returned with the quoted "red car", which will search for "red car" and not "red AND car".

[Ayn]

You can check exactly what the subsearch will return by just running it on its own, including the format at the end. I just tried recreating your scenario and get the search string ( "red car" ) OR ( "blue car" ). If you're getting the same string, I don't see why Splunk would behave like you describe. It should match the whole string, not inidividual words.