Splunk Search

How to adjust search to include names that are also hyphenated

dougsummersett
New Member

We ingest patient records into Splunk and some compliance users need to search to see if an employee accessed records of family members. We create a report that shows any employee that accesses a record that exactly matches their last name. This will not match any patients that might be hyphenated or apostrophe.

How can I adjust my search to make it not an exact match but if it contains the same value?

0 Karma

woodcock
Esteemed Legend

Here is a run-anywhere search that proves that hyphenated searches do work:

index=_* AND "data.instance_guid"="*-*-*-*-*"

Are you saying that one of your datasets has stripped the hyphens and apostrophes from the dataset so you need to normalize one side or the other to do the search?

0 Karma

aberkow
Builder

Hi - I played around with a bunch of the options from here: https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/ConditionalFunctions#match.28SUBJ...

And got the below code to work -

{code}
| makeresults count=1
| streamstats count
| eval Name2 = "Name2"
| eval hyphenNameThatShouldMatch=case(count=1, "Name1-Name2")
| eval hyphenNameThatShouldntMatch=case(count=1, "Name3-Name4")
| eval match=case(like(hyphenNameThatShouldMatch,"%".Name2."%"), 1)
| eval shouldntMatch=case(like(hyphenNameThatShouldntMatch,"%".Name2."%"), 1)
| table Name2, hyphenNameThatShouldMatch, match, hyphenNameThatShouldntMatch, shouldntMatch
{code}

Basically, you asked Splunk to return a bool for whether there was a "like" regex match for the name with wildcards on each side, you can trim this if you know things like where the pattern should match more accurately.

Hope this helps!

0 Karma

oscar84x
Contributor

Could you share your search as well a sample event or just the field containing the value you're searching for?

0 Karma

dougsummersett
New Member

Here is the search we are using to match the user and patient's last names.

index="clinical_applications" sourcetype=app | eval USER_NAME=split(USER_NAME,",") | eval USER_NAME_LAST=mvindex(USER_NAME,0) | eval USER_NAME_FIRST=mvindex(USER_NAME,1) | eval PATIENT_LAST_NAME=upper(PATIENT_LAST_NAME) | eval PATIENT_FIRST_NAME=upper(PATIENT_FIRST_NAME) | where PATIENT_LAST_NAME = USER_NAME_LAST | strcat PATIENT_FIRST_NAME " " PATIENT_LAST_NAME PATIENT_NAME | convert ctime(_time) as Time | rename EPIC_ENTERPRISE_MRN_ID as MRN_ID | rename METRIC_DESCRIPTION as ACTION | table Time,USER_NAME,WORKSTATION,PATIENT_NAME,MRN_ID,ENVIRONMENT,ACTION

0 Karma

dougsummersett
New Member

In this search, we split the user_name field into first and last name then convert to upper case then compare the user last name and patient last name. After that we make it pretty for the users to read.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...