Splunk Search

How to find the most matching result?

CcCcCcCcCc1
New Member

Dear all Splunkers

I'm a newbie for splunk and quite frustrated any method can do somekind of compare/find the most matching result in search?

Here are the situation, allow user input a value with XXXX-XXXX-XXXX-XXXX-XXXX standard and match with below ID

ID  
AAAA-BBBB-CCCC-DDDD 
AAAA-BBBB-CCCC  
AAAA-BBBB       

what i want find the most matching result

for Example input AAAA-BBBB-XXXX-YYYY-ZZZZ

ID  
AAAA-BBBB-CCCC-DDDD -> No match result
AAAA-BBBB-CCCC       -> No match result
AAAA-BBBB             -> Match with AAAA-BBBB -->> return some value

Another Example input AAAA-BBBB-CCCC-YYYY-ZZZZ

ID  
AAAA-BBBB-CCCC-DDDD     -> No match result
AAAA-BBBB-CCCC        -> Match with AAAA-BBBB-CCCC -->> return some value
AAAA-BBBB              -> No need to match with this 

Tried to split the text first but no idea whats next.

Should i use isnull or multisearch?? hope your can give me some hints on that 🙂 cheers

0 Karma

jkat54
SplunkTrust
SplunkTrust

Use the regex command:

... | regex aaaaa-bbbbb-ccccc

Etc

https://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Regex

0 Karma

sundareshr
Legend

Here is a runanywhere sample that you can try.

| makeresults | eval x=" AAAA-BBBB-CCCC-DDDD;AAAA-BBBB-CCCC;AAAA-BBBB" | makemv x delim=";" | mvexpand x | eval y="AAAA-BBBB-CCCC-YYYY-ZZZZ" | eval m=if(match(y, x."*"), "y", "n") | makemv x delim="-" | where m="y" | eventstats max(eval(mvcount(x))) as max  | where mvcount(x) = max
0 Karma
Get Updates on the Splunk Community!

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...