Splunk Search

How would we match static content of error to interesting fields of splunk search by editing lookup table with regex?

Naga1
Loves-to-Learn Lots

If we have some error messages with some static and dynamic content. We want to match static content of error to interesting fields of splunk search by editing lookup table with regex please suggest a possible solution here.

 

error:

Connection timed out 65143

static content : Connection timed out 

dynamic content : 65143

Labels (6)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try defining WILDCARD lookups in the lookup definition for the field e.g.

Connection timed out *
0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...