How can I format field with relative fieldname ?

[Chaser]

My task is format field "app" with relative fieldname

How can I use format command to format as example: (app=*app1* OR  app=*app2* OR *app3* OR ...)

please help me, thanks

[yuanliu]

What is a "relative fieldname"?  What do the asterisks (*) in your example represent?  What is the data like, or the output of your search like? (Or what do raw data look like and your search look like?)

[Chaser]

the asterisk(*) mean: if search *sharepoint*, it will show all of result have "sharepoint"

[yuanliu]

Something like this?

| makeresults
| fields - _time
| eval app = mvappend("*app1*", "*app2*")
| format

[Chaser]

the result like picture on above, but I want all double quote (") transfer to asterisk (*), can you help me

[yuanliu]

The easiest, and in my opinion semantically the most explicit, method would be to enter asterisks into the lookup table.

If you cannot change the table (I don't see any obstacle to that but), you can just alter it after inputlookup.

| inputlookup app_whitelist.csv
| fields app
| eval app = "*" . app . "*" ``` assuming app is single valued ```
| format

[Chaser]

Can I completely replace double quotes with asterisks ?

[yuanliu]

The output is just a string, and search is the field name.  Yes you can use string manipulation to change anything, like

| rex mode=sed field=search "s/\"//g" ``` this only works if app values do not include quotation marks ```

But why?  Not only is this unnecessary, it is wrong in terms of code hygiene.  Splunk already gives you the necessary and sufficient syntax so it doesn't matter what is in the fields being formatted the search term will be faithful to the requirement.  Stripping quotes only makes it less stable.

[Chaser]

fieldname is app, I mean, data have an app named Microsoft.sharepoint, but I input "sharepoint" it's still worked and it's understood Microsoft.sharepoint