Splunk Search

Match substring in list to event

jq06
New Member

I am using lookup to "house" this long list of keywords. Now, I want to run a query against field A (eg. ABC-DEF-ZYL) of my events, to see if there is a substring match against the list of keywords (eg. DEF) How do I: 1) Run the search through so that an additional column comes up to show what has been positively matched. 2) Sort keywords by highest number of occurrence

Tags (1)
0 Karma
1 Solution

David
Splunk Employee
Splunk Employee

This may not be the best approach, but I think it should get you there.

Assuming the keywords (DEF) and field A (ABC-DEF-ZYL) are going to be exactly that format (e.g., Field A will have a series of keywords separated by hyphens), I would probably take the following approach:

YourSearch | makemv delim="-" FieldA | lookup MyTable FieldA OUTPUT Description | search Description=*

Where your lookup table is:

FieldA,Description
ABC,ABC
DEF,DEF
ZYL,ZYL

You could then do stats based off that, such as:

YourSearch | makemv delim="-" FieldA | Lookup MyTable FieldA OUTPUT Description 
           | search Description=* | stats count by Description

http://www.splunk.com/base/Documentation/latest/SearchReference/Makemv

http://www.splunk.com/base/Documentation/latest/SearchReference/Lookup

View solution in original post

0 Karma

David
Splunk Employee
Splunk Employee

This may not be the best approach, but I think it should get you there.

Assuming the keywords (DEF) and field A (ABC-DEF-ZYL) are going to be exactly that format (e.g., Field A will have a series of keywords separated by hyphens), I would probably take the following approach:

YourSearch | makemv delim="-" FieldA | lookup MyTable FieldA OUTPUT Description | search Description=*

Where your lookup table is:

FieldA,Description
ABC,ABC
DEF,DEF
ZYL,ZYL

You could then do stats based off that, such as:

YourSearch | makemv delim="-" FieldA | Lookup MyTable FieldA OUTPUT Description 
           | search Description=* | stats count by Description

http://www.splunk.com/base/Documentation/latest/SearchReference/Makemv

http://www.splunk.com/base/Documentation/latest/SearchReference/Lookup

0 Karma

David
Splunk Employee
Splunk Employee

I'm glad it works. I should improve my point by saying that a "better" approach would probably be to have the Description be something actually useful. For example, in your Lookup table, you could have:
ABC,"ABC - Transaction successful"
DEF,"DEF - Database Deadlock, Contact Support Immediately!"
And then the rest would work just fine. You might change the last query to
...| search Description=* | stats count by FieldA
to maintain statistics about FieldA, from from a methodology perspective, if we're adding data we should add useful data. Anyway -- Food for Thought.

0 Karma

jq06
New Member

Great stuff! Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...