Splunk Search

How to search dynamic field in Splunk?

sbhatnagar88
Path Finder

Hi,

I have a lookup table where column names are with weekdays (like monday, tuesday, wednesday,...) and have possible values as 1 and 0 only.

What I want to achieve..

...some query | eval day=strftime(now(),"%A") | where 'day'=1

but this doesn't seems to be working. Any idea how to search dynamic fields.

 

Thanks

Labels (1)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sbhatnagar88,

which are the lookup fields?

if they are:

  • day (like monday, tuesday, wednesday,...)
  • value (0 or 1)

your search must be different:

...some query 
| eval day=strftime(now(),"%A") 
| search [ | inputlookup your_lookup.csv WHERE value="1" | fields day ]
| ...

put attention that the "day" values from the main search and from the lookup are the same.

Ciao.

Giuseppe

0 Karma

sbhatnagar88
Path Finder

Hi  @gcusello ,

My search itself begins with searching from KV lookup.  and that kv lookup have column name with day name something like

host    Type  monday  tuesday  wednesday  thursday   friday   saturday  sunday

ABC      X         1                 1                  1                     1                   1                 0              0

DEF       Y          0                0                  0                     0                    0                  1              1

I am using below query..

| inputlookup test | search type="ABC"  | eval day=strftime(now(),"%A")   | where 'day'=1

Basically I want to search dynamic day from my lookup.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sbhatnagar88,

I don't thing that's possible to have what you would, I think that you should think to a different structure for your lookup, e.g.:

  • host,
  • day,
  • value,

then you could run something like this:

| inputlookup test 
| search host="ABC"  
| search day=strftime(now(),"%A") AND value=1

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...