How to get word on search and save on new column tables ?

[nisnes12]

Hello guys,

I have a search,

sourcetype=example "testword" OR "abcd" |  table _time _raw 

If I run this query, I get some result because triggered on the testword or abcd (string). My question, how do I find the word that causes the result to appear and that word I display in the table column?

Example:

table
_raw : abcd is the only alphabet
word : abcd
_time : 18:00

_raw : this only testword
word : testword
_time : 18:00

Please help me, create a value of column word from a word on a search, thanks.

[FrankVl]

This feels like a very cumbersome approach to achieve something that might be achieved much more easily in other ways. But without any understanding of the actual data and the end goal that you want to achieve, that is a bit difficult to provide any concrete suggestions.

[renjith_nair · Accepted solution]

@nisnes12 ,

Not sure about the use case but it's always better to extract the field and do the comparison. Regardless of that, if you want to find the string matching the event, try this

|eval word_matched=if(searchmatch("abcd"),"abcd","testword")

[nisnes12]

thanks for your answers, but how to i have many string in the query ? example i have 100 string for condition

[niketn]

@nisnes12 in your SPL while filtering data for index do you filter 100 words? Or one or two of 100 values? How do you apply filter? Can you share your current SPL and elaborate your issue?

[nisnes12]

sourcetype=example "testword" OR "abcd" OR "test" OR "ball" OR "happy" (and many more) | table _time _raw

i think good to use case command for this issue, what about you ?

[renjith_nair]

@nisnes12, you can use case as well if there are multiple values. However if you have a specific pattern or field where these strings appear, then it would be more efficient and easy. What's your use case and final result you want to achieve?

[nisnes12]

yes use case function, how about my word is regex words ? example sourcetype=example "testword" OR "abcd" | eval word=case(match(_raw,"(delmitier)*abc"),"abcd") | table _time _raw
, if i use case , i get error 'Error in 'eval' command: Regex: quantifier does not follow a repeatable item'