Splunk Search

If a field includes certain number of predefined strings?

splunkerer
Path Finder

Hi,

data set to search in field1:  ("foo", "bar", execute", "thanx", "tax", "trade" )

if field1 includes any random 3 of the strings in the data set, It will show up in the search result.

1. field1 = " book car test sell buy trade execute". -- > WONT match at least tree of the items in the data set.

2. field1="book bar execute tax test". --> WILL match since "bar", "execute" and "tax" are included in field1

3. field1="test foo exec bar car". --> WONT match at least tree of the items in the data set.

Please let me know how I can do it.

Thanks,

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming the data set you want to match against is a mv-field and the fields you want to check are space delimited, you could try this:

| makeresults 
| eval dataset=split("foo,bar,execute,thanx,tax,trade",",")
| eval field1=split("book car test sell buy trade execute|book bar execute tax test|test foo exec bar car","|")
| mvexpand field1


| eval mvfield1=split(field1," ")
| eval tomatch=mvjoin(dataset,"|")
| nomv tomatch
| eval mvfieldmatched=mvcount(mvmap(mvfield1,if(match(mvfield1,tomatch),mvfield1,null)))

Split the field to be searched into a mv-field and join the match dataset with "|" to create a regex. Then for each word in the mv-field see if it matches anything in the list, and count the matches. If you need to count a match only once e.g. trade is repeated, then you could wrap the mvmap in mvdedup i.e. mvcount(mvdedup(mvmap(...)))

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming the data set you want to match against is a mv-field and the fields you want to check are space delimited, you could try this:

| makeresults 
| eval dataset=split("foo,bar,execute,thanx,tax,trade",",")
| eval field1=split("book car test sell buy trade execute|book bar execute tax test|test foo exec bar car","|")
| mvexpand field1


| eval mvfield1=split(field1," ")
| eval tomatch=mvjoin(dataset,"|")
| nomv tomatch
| eval mvfieldmatched=mvcount(mvmap(mvfield1,if(match(mvfield1,tomatch),mvfield1,null)))

Split the field to be searched into a mv-field and join the match dataset with "|" to create a regex. Then for each word in the mv-field see if it matches anything in the list, and count the matches. If you need to count a match only once e.g. trade is repeated, then you could wrap the mvmap in mvdedup i.e. mvcount(mvdedup(mvmap(...)))

0 Karma

splunkerer
Path Finder

Thanks a lot @ITWhisperer, your solutions are the best as always. 🙂

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...