Splunk Search

How can I format field with relative fieldname ?

Chaser
Explorer

My task is format field "app" with relative fieldname

How can I use format command to format as example: (app=*app1* OR  app=*app2* OR *app3* OR ...)

please help me, thanks

Labels (3)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

What is a "relative fieldname"?  What do the asterisks (*) in your example represent?  What is the data like, or the output of your search like? (Or what do raw data look like and your search look like?)

0 Karma

Chaser
Explorer

the asterisk(*) mean: if search *sharepoint*, it will show all of result have "sharepoint"

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Something like this?

| makeresults
| fields - _time
| eval app = mvappend("*app1*", "*app2*")
| format

 

0 Karma

Chaser
Explorer

Chaser_0-1671691461098.png

the result like picture on above, but I want all double quote (") transfer to asterisk (*), can you help me

0 Karma

yuanliu
SplunkTrust
SplunkTrust

The easiest, and in my opinion semantically the most explicit, method would be to enter asterisks into the lookup table.

If you cannot change the table (I don't see any obstacle to that but), you can just alter it after inputlookup.

| inputlookup app_whitelist.csv
| fields app
| eval app = "*" . app . "*" ``` assuming app is single valued ```
| format

 

0 Karma

Chaser
Explorer

Can I completely replace double quotes with asterisks ?

0 Karma

yuanliu
SplunkTrust
SplunkTrust

The output is just a string, and search is the field name.  Yes you can use string manipulation to change anything, like

| rex mode=sed field=search "s/\"//g" ``` this only works if app values do not include quotation marks ```

But why?  Not only is this unnecessary, it is wrong in terms of code hygiene.  Splunk already gives you the necessary and sufficient syntax so it doesn't matter what is in the fields being formatted the search term will be faithful to the requirement.  Stripping quotes only makes it less stable.

0 Karma

Chaser
Explorer

fieldname is app, I mean, data have an app named Microsoft.sharepoint, but I input "sharepoint" it's still worked and it's understood Microsoft.sharepoint

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...