Splunk Search

Detecting keywords from another search in a field from other search

tirusplunk
Engager

Hi Guys,

I have a requirement like this. In a search I am getting a field like
ExtraInfo Count
User-Gmail-GoogleChrome 6
Inbox-Yahoo! Mail 3
.....

In another I have keywords like Gmail,Yahoo! Mail,...etc.

I want to write a query which gives me the output like this.

Keyword Count
Gmail 6
Yahoo! Mail 3

Could you please help me in this regard?

0 Karma

somesoni2
Revered Legend

Try this

<first search giving fields ExtraInfo,Count> | fields ExtraInfo, Count | eval joinfield=1
| join type=left max=0 joinfield [search <second search giving fields Keyword> | fields Keyword | eval joinfield=1] | eval shouldInclude=if(like(ExtraInfo,"%".Keyword."%"),"Yes","No") | where shouldInclude="Yes" | fields Keyword, Count
0 Karma

tirusplunk
Engager

ExtraInfo!=ExtraInfo|eval X=case(ExtraInfo LIKE "%Gmail%","Gmail",ExtraInfo LIKE "%Outlook Web App%","Outlook Web App",ExtraInfo LIKE "%Yahoo! Mail%","Yahoo! Mail")

I could think of this. But can I manage this big case statement(this case statement may grow) like an event-type or something else in my splunk?

0 Karma

HiroshiSatoh
Champion

Configuration of the Lookup table files and Lookup definitions are required.


.....|join ExtraInfo[ | inputlookup lookup_tbl]|table Keyword,Count

ExtraInfo,Keyword
"User-Gmail-GoogleChrome","Gmail"
"User-Gmail-GoogleChromeXXX","Gmail"
"User-Gmail-GoogleChromeYYY","Gmail"
"Inbox-Yahoo! Mail","Yahoo! Mail"
"Inbox-Yahoo! MailXXX","Yahoo! Mail"
"Inbox-Yahoo! MailYYY","Yahoo! Mail"

0 Karma

HiroshiSatoh
Champion

Custom field cannot be edited without a LOOKUP?

....|rex field=ExtraInfo "-(?.*)$"|table Keyword


Gmail-GoogleChrome
Yahoo! Mail

0 Karma

tirusplunk
Engager

Can I place only keywords in lookup table instead of both ExtraInfo and Keyword?

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...