Splunk Search

Join fields with partly matching

msrama5
Explorer

Hi All, I have query below that needs to modified for sub string matching condition -

splunk query:

 

sourcetype=source1 id1="*" OR sourcetype=source2 id2="*" OR sourcetype=source3 id2="*"
Id=coalesce(id1,id2,id3)
| stats count by Id sourcetype
| xyseries Id sourcetype count | fillnull source1 source2 source3 value="Not exists"
| table source1 source2 source3

 

when 
id1=F80C05F3-19AF-40D3-AC73-19544E928D21
id2=XOP-F80C05F3-19AF-40D3-AC73-19544E928D21
id3=ABC-F80C05F3-19AF-40D3-AC73-19544E928D21


The query above needs to be modified for substring matching based on id1 existing in id2 or id3 and it needs to return the results, how can this query below be modified?

Labels (3)
Tags (1)
0 Karma

to4kawa
Ultra Champion
(sourcetype=source1 id1="*") OR (sourcetype=source2 id2="*") OR (sourcetype=source3 id2="*")
| eval Id=coalesce(id1,id2,id3)
| eval ID=mvindex(split(Id,"-"),-1)
| stats count by ID sourcetype
| xyseries ID sourcetype count |
| fillnull source1 source2 source3 value="Not exists"
| table source1 source2 source3

hi @msrama5 
How about this?

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Is the difference always a prefix that ends with a hyphen?

Is the prefix always three characters?

Is the ID always 36 characters long?

If so, then use this-

| eval matchId=coalesce(id1,id2,id3)
| eval matchId=substr(matchId,len(matchId)-35,36) 

 

0 Karma

msrama5
Explorer

@to4kawa any ideas on this ?

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...