Splunk Search
Highlighted

How to find the most matching result?

New Member

Dear all Splunkers

I'm a newbie for splunk and quite frustrated any method can do somekind of compare/find the most matching result in search?

Here are the situation, allow user input a value with XXXX-XXXX-XXXX-XXXX-XXXX standard and match with below ID

ID  
AAAA-BBBB-CCCC-DDDD 
AAAA-BBBB-CCCC  
AAAA-BBBB       

what i want find the most matching result

for Example input AAAA-BBBB-XXXX-YYYY-ZZZZ

ID  
AAAA-BBBB-CCCC-DDDD -> No match result
AAAA-BBBB-CCCC       -> No match result
AAAA-BBBB             -> Match with AAAA-BBBB -->> return some value

Another Example input AAAA-BBBB-CCCC-YYYY-ZZZZ

ID  
AAAA-BBBB-CCCC-DDDD     -> No match result
AAAA-BBBB-CCCC        -> Match with AAAA-BBBB-CCCC -->> return some value
AAAA-BBBB              -> No need to match with this 

Tried to split the text first but no idea whats next.

Should i use isnull or multisearch?? hope your can give me some hints on that 🙂 cheers

0 Karma
Highlighted

Re: How to find the most matching result?

Legend

Here is a runanywhere sample that you can try.

| makeresults | eval x=" AAAA-BBBB-CCCC-DDDD;AAAA-BBBB-CCCC;AAAA-BBBB" | makemv x delim=";" | mvexpand x | eval y="AAAA-BBBB-CCCC-YYYY-ZZZZ" | eval m=if(match(y, x."*"), "y", "n") | makemv x delim="-" | where m="y" | eventstats max(eval(mvcount(x))) as max  | where mvcount(x) = max
0 Karma
Highlighted

Re: How to find the most matching result?

SplunkTrust
SplunkTrust

Use the regex command:

... | regex aaaaa-bbbbb-ccccc

Etc

https://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Regex

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.