Splunk Search

Build filter from inputlookup

hvdtol
Path Finder

I would kindly need some help for a query i am not able to create.


I have  inputlookups as source.
And i want to filter with rows from another inputlookup

Simplified:

| inputlookup errmess_dev.csv
| append [| inputlookup errmess_prod.csv]
| table env,msg

DEV          we are running out of cola too much sugar
PROD      we are running out of wine better take juice
PROD      we are running out of beer not so good

I have another inputlookup which should be used as a filter.
| inputlookup filterlines
| table filter
  running out of wine
  out of cola

I want to establish this: build the search filter from the inputlookup.
How can i do this? Or is there perhaps a better way?

| inputlookup errmess_dev.csv
| append [| inputlookup errmess_prod.csv]
| table env,msg
| search NOT (errmsg="*out of beer*" OR errmsg="*out of wine*")
| table, errmsg

Any help is appreciated.
Regards

Harry

Labels (1)
0 Karma
1 Solution

hvdtol
Path Finder

Yes, thank you (and i) made it work.

For some reason i had to make a change. This was the outcome:

| inputlookup filterlines | eval errmsg="*".filter."*" | format
( ( errmsg="*running out of wine*" AND filter="running out of wine" ) OR ( errmsg="*out of cola*" AND filter="out of cola" ) )

I changed it to:
| inputlookup filterlines | rename filter as errmsg | eval errmsg="*".errmsg."*" | format

View solution in original post

0 Karma

hvdtol
Path Finder

Yes, thank you (and i) made it work.

For some reason i had to make a change. This was the outcome:

| inputlookup filterlines | eval errmsg="*".filter."*" | format
( ( errmsg="*running out of wine*" AND filter="running out of wine" ) OR ( errmsg="*out of cola*" AND filter="out of cola" ) )

I changed it to:
| inputlookup filterlines | rename filter as errmsg | eval errmsg="*".errmsg."*" | format

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@hvdtol 

You can try something like this.

| inputlookup errmess_dev.csv
| append [| inputlookup errmess_prod.csv]
| table env,msg
| search NOT [| inputlookup filterlines | eval filter="*".filter."*" | format]
| table, errmsg

 

If this reply helps you, an upvote would be appreciated.

 

Thanks
Kamlesh Vaghela

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@hvdtol 

If this reply helps you, an upvote would be appreciated.

0 Karma

hvdtol
Path Finder

Thank you, this was helpfull

 

Regards,

 

Harry

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...