Splunk Search

How to search string abc/efg in log using multiselect field?

wangkevin1029
Communicator

Hi, Splunkers, 

 

I  want to search string like abc/efg in my log using  multiselect field. 

I directly defined this  search value  abc/efg in multiselect field , token  name "keyword"

in my query, I use $keyword" to search,  it doesn't' work,  I also try  abc\/efg, it doesn't work either,  but other normal string works here.

 

any ideas? 

 

thx in advance.

 

Kevin

 

 

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Depending on data, some methods can be more efficient than others.  Here is the most generic method if you truly want to search for a string that may appear anywhere in the event. (In other words, you must satisfy ("*abc*" OR "*efg*"). Extremely expensive.)

<input type="multiselect" token="keyword">
  <choice value="abc">abc</choice>
  <choice value="efg">efg</choice>
  <prefix>(</prefix>
  <suffix>)</suffix>
  <delimiter> OR </delimiter>
  <valuePrefix>&quot;*</valuePrefix>
  <valueSuffix>*&quot;</valueSuffix>
</input>

Then in search, you just say $keyword$.  There can be many variations of this, especially in regard to prefix and suffix.  For example, you can include all the asterisk, quotation mark, in value and do not use <valuePrefix/> and <valueSuffix/>; you can also do ($keyword$) in search and do away with <prefix/> and <suffix/>. (This question better belongs to reporting & dashboard forum.)

0 Karma

wangkevin1029
Communicator

I  retried  abc\/efg, it works now, thx you, anyway.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...