Splunk Enterprise Security

Substituting values from MV fields?

Communicator

In Enterprise Security, for a drill down action I want to use a field from the notable events, which can have multi valued fields as well.

In this case, if I simply do myfieldinthesearch=$myfieldinthe_notable$ in the drilldown search, the values are presented as follows:

myfieldinthesearch=value1,value2,value3

It cannot be used like this obviously, I would like to achieve something like

myfieldinthesearch=value1 OR myfieldinthesearch=value2, etc...

Is it possible to do this somehow?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

It seems a bit much to have to do, but this would work, as long as some value is selected...

Instead of ...

  index=foo my_field_in_the_search=$myfield_in_the_notable$ 

...you could code the search...

 index=foo [| makeresults |eval my_field_in_the_search=$myfield_in_the_notable$ | makemv delim="," my_field_in_the_search | mvexpand my_field_in_the_search | table my_field_in_the_search | format]

And the format command will turn it into ...

((my_field_in_the_search=value1) OR (my_field_in_the_search=value2)....)

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

It seems a bit much to have to do, but this would work, as long as some value is selected...

Instead of ...

  index=foo my_field_in_the_search=$myfield_in_the_notable$ 

...you could code the search...

 index=foo [| makeresults |eval my_field_in_the_search=$myfield_in_the_notable$ | makemv delim="," my_field_in_the_search | mvexpand my_field_in_the_search | table my_field_in_the_search | format]

And the format command will turn it into ...

((my_field_in_the_search=value1) OR (my_field_in_the_search=value2)....)

View solution in original post

0 Karma

Communicator

This is great, thanks!