@yuanliu - There are two ways:
1. Organize the lookup from larger values for the narrowest match to smaller values. Keep the wild card on the top.
-> As you mentioned, this requires manually organizing the lookup.
2. Use Python-based custom command:
-> I'm not including commands.conf or full code for Python, something I guess you already know of find from Splunk docs. Just included the logic part.
'''
This function matches the wildcard and returns how many characters matches exactly
In your case, it would help you find the narrowest match from the lookup
'''
def wildcard_match(text, match_string):
# Split the match string by *
parts = match_string.split('*')
# Initialize variables
match_count = 0
text_index = 0
# Iterate over the parts
for part in parts:
if part:
# Find the index of the current part in the text
index = text.find(part, text_index)
if index == -1:
return match_count
else:
match_count += len(part)
text_index = index + len(part)
return match_count
'''
And you can wrap the above function in a loop over the whole lookup to find which one matches the closest.
This returns (<match-from-lookup>, <X number'th entry matches the narrowest>)
'''
def find_best_match_from_lookup(match_strings, text):
best_match_string = None
highest_result = 0
for index, match_string in enumerate(match_strings):
result = wildcard_match(text, match_string)
if result > highest_result:
highest_result = result
best_match_string = match_string
return best_match_string, index
# And from here you can use that index to return whatever you need to return
I hope this helps!!! Kindly upvote if it does!!!
