Splunk Search

Match from a lookup table

New Member

Hi,
I'm new at Splunk and I need some help.
I have a query that looks like this:
sourcetype = ... index = ... | eval appel = box (match (wasRequestURL, ". * / api / smthg / smthgX /./ smthgY"), "/ api / smthg / smthgX / {id} / smthgY", match (wasRequestURL, ". * / api /smthg/smthgX/./smthgY/./smthgXY."),"/api/smthg/smthgX/{id}/smthgY/{id}/smthgXY ") |stats count, avg (ResponseTime) as TMoy by calls, http-method

I created a lookup file that contains 2 fields:
url, url_corresp
". * / Api / smthg / smthgX /.*/ smthgY", "/ api / smthg / smthgX / {id} / smthgY"

I would like to apply a match that loop on the url of the lookup and assign appel to the corresponding url, is it possible to do it?
otherwise if there is another more optimized solution because I have a long list of urls that are heterogeneous and even a regex is heavy to apply!
Thank you in advance

0 Karma
1 Solution

SplunkTrust
SplunkTrust

You'd need to change your lookup table to do wildcard match, then use the lookup command instead of eval-case. See this link for a sample implementation of lookup with wildcard match. You'd need to add appropriate wildcard character * in your lookup table field url's value which you'll be matching with field wasRequestURL.

https://answers.splunk.com/answers/52580/can-we-use-wildcard-characters-in-a-lookup-table.html

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

You'd need to change your lookup table to do wildcard match, then use the lookup command instead of eval-case. See this link for a sample implementation of lookup with wildcard match. You'd need to add appropriate wildcard character * in your lookup table field url's value which you'll be matching with field wasRequestURL.

https://answers.splunk.com/answers/52580/can-we-use-wildcard-characters-in-a-lookup-table.html

View solution in original post

0 Karma

New Member

I understand the solution but the problem now that I don't have access to transforms.conf 😕
Anyway, thanks for your answer 🙂

0 Karma