If a field includes certain number of predefined strings?

[splunkerer]

Hi,

data set to search in field1:  ("foo", "bar", execute", "thanx", "tax", "trade" )

if field1 includes any random 3 of the strings in the data set, It will show up in the search result.

1. field1 = " book car test sell buy trade execute". -- > WONT match at least tree of the items in the data set.

2. field1="book bar execute tax test". --> WILL match since "bar", "execute" and "tax" are included in field1

3. field1="test foo exec bar car". --> WONT match at least tree of the items in the data set.

Please let me know how I can do it.

Thanks,

[ITWhisperer · Accepted solution]

Assuming the data set you want to match against is a mv-field and the fields you want to check are space delimited, you could try this:

| makeresults 
| eval dataset=split("foo,bar,execute,thanx,tax,trade",",")
| eval field1=split("book car test sell buy trade execute|book bar execute tax test|test foo exec bar car","|")
| mvexpand field1


| eval mvfield1=split(field1," ")
| eval tomatch=mvjoin(dataset,"|")
| nomv tomatch
| eval mvfieldmatched=mvcount(mvmap(mvfield1,if(match(mvfield1,tomatch),mvfield1,null)))

Split the field to be searched into a mv-field and join the match dataset with "|" to create a regex. Then for each word in the mv-field see if it matches anything in the list, and count the matches. If you need to count a match only once e.g. trade is repeated, then you could wrap the mvmap in mvdedup i.e. mvcount(mvdedup(mvmap(...)))

[splunkerer]

Thanks a lot @ITWhisperer, your solutions are the best as always. 🙂