Splunk Search

Match from a lookup table

BenImen
New Member

Hi,
I'm new at Splunk and I need some help.
I have a query that looks like this:
sourcetype = ... index = ... | eval appel = box (match (wasRequestURL, ". * / api / smthg / smthgX /./ smthgY"), "/ api / smthg / smthgX / {id} / smthgY", match (wasRequestURL, ". * / api /smthg/smthgX/./smthgY/./smthgXY."),"/api/smthg/smthgX/{id}/smthgY/{id}/smthgXY ") |stats count, avg (ResponseTime) as TMoy by calls, http-method

I created a lookup file that contains 2 fields:
url, url_corresp
". * / Api / smthg / smthgX /.*/ smthgY", "/ api / smthg / smthgX / {id} / smthgY"

I would like to apply a match that loop on the url of the lookup and assign appel to the corresponding url, is it possible to do it?
otherwise if there is another more optimized solution because I have a long list of urls that are heterogeneous and even a regex is heavy to apply!
Thank you in advance

0 Karma
1 Solution

somesoni2
Revered Legend

You'd need to change your lookup table to do wildcard match, then use the lookup command instead of eval-case. See this link for a sample implementation of lookup with wildcard match. You'd need to add appropriate wildcard character * in your lookup table field url's value which you'll be matching with field wasRequestURL.

https://answers.splunk.com/answers/52580/can-we-use-wildcard-characters-in-a-lookup-table.html

View solution in original post

0 Karma

somesoni2
Revered Legend

You'd need to change your lookup table to do wildcard match, then use the lookup command instead of eval-case. See this link for a sample implementation of lookup with wildcard match. You'd need to add appropriate wildcard character * in your lookup table field url's value which you'll be matching with field wasRequestURL.

https://answers.splunk.com/answers/52580/can-we-use-wildcard-characters-in-a-lookup-table.html

0 Karma

BenImen
New Member

I understand the solution but the problem now that I don't have access to transforms.conf 😕
Anyway, thanks for your answer 🙂

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...