Splunk Search

How to search if data contain value from the other fields?

urapaveerapan
Explorer

Hi

I'm very new in Splunk, I'd like to find the event where the short description contain the "Category" or "Subcategory field. (Example in the the yellow highlight.
Other than the field value, how can I match the related words between the fields?
For example,
"CBM Precast" related to "Truck loading" and "GI"
If the Splunk found "Truck loading" or"GI", it also mean that this event match with "Category" field as well.

Please help!!

alt text

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi urapaveerapan,
you have to create a simple search like the following:
if you want a value that fully matches the Category field

index=your_index sourcetype=your_sourcetype Category="CBM Precast" | ...

if you want a value that partially matches the Category field

index=your_index sourcetype=your_sourcetype Category="*Precast*" | ...

or if you're not sure of the field to use in search

index=your_index sourcetype=your_sourcetype Precast | ...

Beware that the field name is case sensitive, instead field value isn't.

I suggest to follow the search tutorial that you can find at http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchTutorial/WelcometotheSearchTutorial

Bye.
Giuseppe

0 Karma

urapaveerapan
Explorer

Dear Giuseppe,

The search item is dynamic. It depend on the value in Category or Subcategory fields. So I cannot fill the extact word in its.
Let say, if it is sql query, it gonna be like
select * from [table_name] where [short description] like '%'||Category||'%' or [short description] like '%'||Subcategory||'%'

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi urapaveerapan,
you can try to use

Category="*short_description*" OR Subategory="*short_description*"

Or try using the like option (see at http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/ConditionalFunctions)

... | where like(Category, "%short_description%") OR like(Subcategory, "%short_description%") 

Obviously this search will be not so quick!

Bye.
Giuseppe

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!