Splunk Search

How do I loop through a list of regular expression patterns stored in a KV store in a search?

govardha
Path Finder

I am new to Splunk.

The cluster command gives me results that I am looking for and some. I would like to filter the results of this command with a list of regular expression patterns that I have stored in a KV store, but I am having a tough time getting the answers that I am looking for. When I run the map command below it looks like the $payload$ ends up with the value rather than the field name.

The app_critical_warning KV store has a list of regexp patterns with one of the column names being regexp_pattern.

Here's the search that I have come up with:

index="someindex" msgtype::warning |
cluster t=0.9 showcount=true field=payload |
table cluster_count payload |
map [|inputlookup app_critical_warning |
regex $payload$=regexp_pattern ] maxsearches=10

Does anybody have any suggestions on how to go about this task? I can compose the search with all the regex patterns, but I would like to maintain it in a KV store for logistic reasons.

Thank you!

Labels (2)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...