Splunk Search

Iterate search over multiple field values

Sam1
Explorer

Hi,

I've created a search which is based on 1 field value but I need the search to run over many field values.  Rather than many repeating lines.

What is the best way to do this?  I know what the field values are before the search too.

It will be an alert where if 1 or more field values match the end criteria, an email is sent.  I only want 1 email, not 1 for every field value.

Thanks!

Labels (2)
0 Karma

anilchaithu
Builder

@Sam1 

you can use filed= value1 OR filed=value2 and so on in the search. You can always configure the alert to send an email for each result OR group of results.

anilchaithu_0-1593403878428.png

 

0 Karma

Sam1
Explorer

To give some more detail of my search, it takes the field value and look at the past hour of data, compares that to the past week of data to get the percent difference.  Then show result where diff > x.

This needs to done for each field value though and I don't know how to do that without a lot of evals, addtotals, etc.  I want to be able to do a nice clean short search regardless of the field value, and pass in the field value.

 

Thanks.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!