Splunk Search

Build filter from inputlookup

hvdtol
Path Finder

I would kindly need some help for a query i am not able to create.


I have  inputlookups as source.
And i want to filter with rows from another inputlookup

Simplified:

| inputlookup errmess_dev.csv
| append [| inputlookup errmess_prod.csv]
| table env,msg

DEV          we are running out of cola too much sugar
PROD      we are running out of wine better take juice
PROD      we are running out of beer not so good

I have another inputlookup which should be used as a filter.
| inputlookup filterlines
| table filter
  running out of wine
  out of cola

I want to establish this: build the search filter from the inputlookup.
How can i do this? Or is there perhaps a better way?

| inputlookup errmess_dev.csv
| append [| inputlookup errmess_prod.csv]
| table env,msg
| search NOT (errmsg="*out of beer*" OR errmsg="*out of wine*")
| table, errmsg

Any help is appreciated.
Regards

Harry

Labels (1)
0 Karma
1 Solution

hvdtol
Path Finder

Yes, thank you (and i) made it work.

For some reason i had to make a change. This was the outcome:

| inputlookup filterlines | eval errmsg="*".filter."*" | format
( ( errmsg="*running out of wine*" AND filter="running out of wine" ) OR ( errmsg="*out of cola*" AND filter="out of cola" ) )

I changed it to:
| inputlookup filterlines | rename filter as errmsg | eval errmsg="*".errmsg."*" | format

View solution in original post

0 Karma

hvdtol
Path Finder

Yes, thank you (and i) made it work.

For some reason i had to make a change. This was the outcome:

| inputlookup filterlines | eval errmsg="*".filter."*" | format
( ( errmsg="*running out of wine*" AND filter="running out of wine" ) OR ( errmsg="*out of cola*" AND filter="out of cola" ) )

I changed it to:
| inputlookup filterlines | rename filter as errmsg | eval errmsg="*".errmsg."*" | format

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@hvdtol 

You can try something like this.

| inputlookup errmess_dev.csv
| append [| inputlookup errmess_prod.csv]
| table env,msg
| search NOT [| inputlookup filterlines | eval filter="*".filter."*" | format]
| table, errmsg

 

If this reply helps you, an upvote would be appreciated.

 

Thanks
Kamlesh Vaghela

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@hvdtol 

If this reply helps you, an upvote would be appreciated.

0 Karma

hvdtol
Path Finder

Thank you, this was helpfull

 

Regards,

 

Harry

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!