Splunk Search

Match from a lookup table

BenImen
New Member

Hi,
I'm new at Splunk and I need some help.
I have a query that looks like this:
sourcetype = ... index = ... | eval appel = box (match (wasRequestURL, ". * / api / smthg / smthgX /./ smthgY"), "/ api / smthg / smthgX / {id} / smthgY", match (wasRequestURL, ". * / api /smthg/smthgX/./smthgY/./smthgXY."),"/api/smthg/smthgX/{id}/smthgY/{id}/smthgXY ") |stats count, avg (ResponseTime) as TMoy by calls, http-method

I created a lookup file that contains 2 fields:
url, url_corresp
". * / Api / smthg / smthgX /.*/ smthgY", "/ api / smthg / smthgX / {id} / smthgY"

I would like to apply a match that loop on the url of the lookup and assign appel to the corresponding url, is it possible to do it?
otherwise if there is another more optimized solution because I have a long list of urls that are heterogeneous and even a regex is heavy to apply!
Thank you in advance

0 Karma
1 Solution

somesoni2
Revered Legend

You'd need to change your lookup table to do wildcard match, then use the lookup command instead of eval-case. See this link for a sample implementation of lookup with wildcard match. You'd need to add appropriate wildcard character * in your lookup table field url's value which you'll be matching with field wasRequestURL.

https://answers.splunk.com/answers/52580/can-we-use-wildcard-characters-in-a-lookup-table.html

View solution in original post

0 Karma

somesoni2
Revered Legend

You'd need to change your lookup table to do wildcard match, then use the lookup command instead of eval-case. See this link for a sample implementation of lookup with wildcard match. You'd need to add appropriate wildcard character * in your lookup table field url's value which you'll be matching with field wasRequestURL.

https://answers.splunk.com/answers/52580/can-we-use-wildcard-characters-in-a-lookup-table.html

0 Karma

BenImen
New Member

I understand the solution but the problem now that I don't have access to transforms.conf 😕
Anyway, thanks for your answer 🙂

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...