Splunk Search

How can I format field with relative fieldname ?

Chaser
Explorer

My task is format field "app" with relative fieldname

How can I use format command to format as example: (app=*app1* OR  app=*app2* OR *app3* OR ...)

please help me, thanks

Labels (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

What is a "relative fieldname"?  What do the asterisks (*) in your example represent?  What is the data like, or the output of your search like? (Or what do raw data look like and your search look like?)

0 Karma

Chaser
Explorer

the asterisk(*) mean: if search *sharepoint*, it will show all of result have "sharepoint"

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Something like this?

| makeresults
| fields - _time
| eval app = mvappend("*app1*", "*app2*")
| format

 

0 Karma

Chaser
Explorer

Chaser_0-1671691461098.png

the result like picture on above, but I want all double quote (") transfer to asterisk (*), can you help me

0 Karma

yuanliu
SplunkTrust
SplunkTrust

The easiest, and in my opinion semantically the most explicit, method would be to enter asterisks into the lookup table.

If you cannot change the table (I don't see any obstacle to that but), you can just alter it after inputlookup.

| inputlookup app_whitelist.csv
| fields app
| eval app = "*" . app . "*" ``` assuming app is single valued ```
| format

 

0 Karma

Chaser
Explorer

Can I completely replace double quotes with asterisks ?

0 Karma

yuanliu
SplunkTrust
SplunkTrust

The output is just a string, and search is the field name.  Yes you can use string manipulation to change anything, like

| rex mode=sed field=search "s/\"//g" ``` this only works if app values do not include quotation marks ```

But why?  Not only is this unnecessary, it is wrong in terms of code hygiene.  Splunk already gives you the necessary and sufficient syntax so it doesn't matter what is in the fields being formatted the search term will be faithful to the requirement.  Stripping quotes only makes it less stable.

0 Karma

Chaser
Explorer

fieldname is app, I mean, data have an app named Microsoft.sharepoint, but I input "sharepoint" it's still worked and it's understood Microsoft.sharepoint

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...