Splunk Search

How to search multiple strings from lookup and provide count?


Hi All,

I am working on search to search fields values from the lookup in an index and i have created the below search :

[| inputlookup WAS_ErrorCode.csv | table WASEventCode | rename WASEventCode as query]
| append
  [| inputlookup WAS_ErrorCode.csv
  | stats values(WASEventCode) as WASEventCode]

| eventstats values(WASEventCode) as WASEventCode
| where isnotnull(_raw)
| eval WASEventCode=mvmap(WASEventCode,if(match(_raw,WASEventCode),WASEventCode,null()))
| eventstats count as Ecount by WASEventCode | convert ctime(_time) as time| dedup WASEventCode|lookup WAS_ErrorCode.csv WASEventCode OUTPUT Severity2 Description2 Threshold2 WASEventCode | eval Threshold2=mvindex(Threshold2,0) | eval Severity2=mvindex(Severity2,0)| eval Description2=mvindex(Description2,0) | eval WASEventCode=mvindex(WASEventCode,0) | where Ecount>Threshold2 |eval message="mc_host= "+host+"; mc_object= "+source+"; mc_object_class= "+sourcetype+"; mc_origin= "+host+"; msg='"+WASEventCode+" : "+Description2+" with count as "+Ecount+"'; mc_tool_time= "+time+"; mc_origin_sev= "+Severity2+";"|table message


In the above search , i am searching  field values, WASEventcode from the lookup in index.Please note that this field in not present in index and i am doing text search and it is working fine.Now i want to search the condition which would search another field value from the lookup and it should search both field values which is Description2 of the WASEventcode but not able to do the same

Labels (3)
0 Karma

Super Champion

@Splunk4 - Try this instead:

[| inputlookup WAS_ErrorCode.csv | table WASEventCode | return $WASEventCode]

Appending $ makes text search instead of field search.


I hope this helps!!!

0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...