I'm very new in Splunk, I'd like to find the event where the short description contain the "Category" or "Subcategory field. (Example in the the yellow highlight.
Other than the field value, how can I match the related words between the fields?
"CBM Precast" related to "Truck loading" and "GI"
If the Splunk found "Truck loading" or"GI", it also mean that this event match with "Category" field as well.
you have to create a simple search like the following:
if you want a value that fully matches the Category field
index=your_index sourcetype=your_sourcetype Category="CBM Precast" | ...
if you want a value that partially matches the Category field
index=your_index sourcetype=your_sourcetype Category="*Precast*" | ...
or if you're not sure of the field to use in search
index=your_index sourcetype=your_sourcetype Precast | ...
Beware that the field name is case sensitive, instead field value isn't.
I suggest to follow the search tutorial that you can find at http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchTutorial/WelcometotheSearchTutorial
The search item is dynamic. It depend on the value in Category or Subcategory fields. So I cannot fill the extact word in its.
Let say, if it is sql query, it gonna be like
select * from [table_name] where [short description] like '%'||Category||'%' or [short description] like '%'||Subcategory||'%'
you can try to use
Category="*short_description*" OR Subategory="*short_description*"
Or try using the like option (see at http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/ConditionalFunctions)
... | where like(Category, "%short_description%") OR like(Subcategory, "%short_description%")
Obviously this search will be not so quick!