Splunk Enterprise Security

Taking all pairs of elements in a multivalue field to use it in a macro

eduardoduarte
Explorer

Hello.

I would like to be able to loop along all the elements of a multivalued field to compare all against each other. There is a macro in the following example that receives two arguments, I would like to check all the possible pairs from the mfield "MyField". Is this possible ?

In this example I am just checking the 0th element with the 1st element, but I want to check along all possible pairs in the multivalued field MyField if the outcome of the macro is higher than some value.

| makeresults
| eval MyField="AAA,ZAB,ZAA,RAA"
| makemv delim="," MyField
| eval f0=mvindex(MyField,0)
| eval f1=mvindex(MyField,1)
| `ut_levenshtein(f0,f1)`
| table MyField,f0,f1,ut_levenshtein

0 Karma
1 Solution

jawaharas
Motivator

You can use map command as shown below for your usecase

The map command is a looping operator that runs a search repeatedly for each input event or result.

| makeresults 
| eval MyField1="AAA,ZAB,ZAA,RAA" 
| makemv delim="," MyField1 
| mvexpand MyField1 
| map search="
    | makeresults 
    | eval MyField1=\"$MyField1$\", MyField2=\"AAA,ZAB,ZAA,RAA\" 
    | makemv delim=\",\" MyField2 
    | mvexpand MyField2
    |table MyField1, MyField2 " 
| `ut_levenshtein(MyField1,MyField2)`
| table *

View solution in original post

jawaharas
Motivator

You can use map command as shown below for your usecase

The map command is a looping operator that runs a search repeatedly for each input event or result.

| makeresults 
| eval MyField1="AAA,ZAB,ZAA,RAA" 
| makemv delim="," MyField1 
| mvexpand MyField1 
| map search="
    | makeresults 
    | eval MyField1=\"$MyField1$\", MyField2=\"AAA,ZAB,ZAA,RAA\" 
    | makemv delim=\",\" MyField2 
    | mvexpand MyField2
    |table MyField1, MyField2 " 
| `ut_levenshtein(MyField1,MyField2)`
| table *

eduardoduarte
Explorer

oh, thank you very much. I did modification to your command in order to avoid the hardcoding of MyField2 in the map command.

However, I dunno if you can make a two line summary of what you are doing since I do not understnad how do you get all the combinations in different order.

| makeresults
| eval MyField1="AAA,ZAB,ZAA,RAA"
| eval tField=MyField1
| makemv delim="," MyField1
| mvexpand MyField1
| map search="
| makeresults
| eval MyField1=\"$MyField1$\"
| eval MyField2=\"$tField$\"
| makemv delim=\",\" MyField2
| mvexpand MyField2
|table MyField1, MyField2 "
| ut_levenshtein(MyField1,MyField2)
| table *

0 Karma

jawaharas
Motivator

Glad it helped you.

  • The map command is a looping operator that runs a search repeatedly for each input event
  • The parent query (section before 'map' command) generates 'MyField1' field
  • In the subquery (under 'map' command), 'MyField1' variable is passed in and for each event of parent query, all the events in subquery are executed.

Below SPL might explain you visually

| makeresults 
 | eval MyField1="A,B,C,D" 
 | makemv delim="," MyField1 
 | mvexpand MyField1 
 | map search="
     | makeresults 
     | eval MyField1=\"$MyField1$\", MyField2=\"One,Two,Three,Four\" 
     | makemv delim=\",\" MyField2 
     | mvexpand MyField2
     |table MyField1, MyField2 " 
 | `ut_levenshtein(MyField1,MyField2)`
 | table *

Can you upvote and accept the answer if it's helped you? Thanks.

eduardoduarte
Explorer

Thank you very much! This was really helpful.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...