Splunk Search

If a field includes certain number of predefined strings?

splunkerer
Path Finder

Hi,

data set to search in field1:  ("foo", "bar", execute", "thanx", "tax", "trade" )

if field1 includes any random 3 of the strings in the data set, It will show up in the search result.

1. field1 = " book car test sell buy trade execute". -- > WONT match at least tree of the items in the data set.

2. field1="book bar execute tax test". --> WILL match since "bar", "execute" and "tax" are included in field1

3. field1="test foo exec bar car". --> WONT match at least tree of the items in the data set.

Please let me know how I can do it.

Thanks,

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming the data set you want to match against is a mv-field and the fields you want to check are space delimited, you could try this:

| makeresults 
| eval dataset=split("foo,bar,execute,thanx,tax,trade",",")
| eval field1=split("book car test sell buy trade execute|book bar execute tax test|test foo exec bar car","|")
| mvexpand field1


| eval mvfield1=split(field1," ")
| eval tomatch=mvjoin(dataset,"|")
| nomv tomatch
| eval mvfieldmatched=mvcount(mvmap(mvfield1,if(match(mvfield1,tomatch),mvfield1,null)))

Split the field to be searched into a mv-field and join the match dataset with "|" to create a regex. Then for each word in the mv-field see if it matches anything in the list, and count the matches. If you need to count a match only once e.g. trade is repeated, then you could wrap the mvmap in mvdedup i.e. mvcount(mvdedup(mvmap(...)))

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming the data set you want to match against is a mv-field and the fields you want to check are space delimited, you could try this:

| makeresults 
| eval dataset=split("foo,bar,execute,thanx,tax,trade",",")
| eval field1=split("book car test sell buy trade execute|book bar execute tax test|test foo exec bar car","|")
| mvexpand field1


| eval mvfield1=split(field1," ")
| eval tomatch=mvjoin(dataset,"|")
| nomv tomatch
| eval mvfieldmatched=mvcount(mvmap(mvfield1,if(match(mvfield1,tomatch),mvfield1,null)))

Split the field to be searched into a mv-field and join the match dataset with "|" to create a regex. Then for each word in the mv-field see if it matches anything in the list, and count the matches. If you need to count a match only once e.g. trade is repeated, then you could wrap the mvmap in mvdedup i.e. mvcount(mvdedup(mvmap(...)))

0 Karma

splunkerer
Path Finder

Thanks a lot @ITWhisperer, your solutions are the best as always. 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...