Splunk Search

Query with Thousands IDs in searche whit OR

Dmitriy
Explorer

Hello, i need help.

I have 6500 IIN (like id) and put this id to lookup then tried search: index=alfa [|inputlookup IIN_oleg.csv |rename IIN as search | fields search] 

They given result only for one firs IIN in lookup.

If i search whit out lookup just 10 IIN whit "OR" the give me 10 result

Labels (1)
Tags (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

Try this,

index=alfa [|inputlookup IIN_oleg.csv  |rename IIN as search | table search | format "(" "(" "AND" ")" "OR" ")"] 

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Dmitriy 

One more thing I observed in my instance. Incase if may OR conditions the search it self is getting break.. So can you please run your search and check the job inspect?  Is that any error?

 

0 Karma

Dmitriy
Explorer

start search index=alfa [|inputlookup IIN_oleg.csv |rename IIN as search | fields search] 

search.log 

08-05-2021 12:36:55.531 ERROR LookupProviderFactory - Must specify one or more lookup fields.
08-05-2021 12:36:54.743 INFO  SearchParser - PARSING: search index=alfa [|inputlookup IIN_oleg.csv  |rename IIN as search | fields search] |

 

08-05-2021 12:36:55.531 ERROR LookupProviderFactory - Must specify one or more lookup fields.
08-05-2021 12:36:55.531 ERROR AutoLookupDriver - Could not load lookup='LOOKUP-cisco_asa_ids_lookup' reason='Error in 'lookup' command: Must specify one or more lookup fields.'
08-05-2021 12:36:55.531 ERROR LookupProviderFactory - Must specify one or more lookup fields.
08-05-2021 12:36:55.531 ERROR AutoLookupDriver - Could not load lookup='LOOKUP-cisco_asa_intrusion_severity_lookup' reason='Error in 'lookup' command: Must specify one or more lookup fields.'
Tags (1)
0 Karma

Dmitriy
Explorer

i can not find in logs why the thake only firs value in lookup. I think the problem in query

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Try this,

index=alfa [|inputlookup IIN_oleg.csv  |rename IIN as search | table search | format "(" "(" "AND" ")" "OR" ")"] 

Dmitriy
Explorer

YEEHAA !!! Its work now, they give me correct result. Thank you very much.

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

cool

Glad to help you 🙂

!! Happy Splunking !!

0 Karma

Dmitriy
Explorer

No, not give any result 😔

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Dmitriy 

Can you please try this?

index=alfa 
| rex field=_raw "parameter\sname=\\\\\"(?<name>.*)\\\\\"\svalue=\\\\\"(?<value>\d+)\\\\\"\/&gt;"
| where name="IIN" 
| stats count by value

 

KV 

0 Karma

Dmitriy
Explorer

we dont have field like IIN in index data

Dmitriy_0-1628141909747.png

 

index=alfa 
| rex field=_raw "parameter\sname=\\\\\"(?<name>.*)\\\\\"\svalue=\\\\\"(?<value>\d+)\\\\\"\/&gt;"
| where name="IIN" 
| stats count by value

 Result 0 

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Dmitriy 

What is the value in field name ?

 

0 Karma

Dmitriy
Explorer

the IIN dont have field name in index

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

OK

Then how you want to map with  IIN_oleg.csv?

0 Karma

Dmitriy
Explorer

lookup data

Dmitriy_0-1628140417808.png

data in index

Dmitriy_1-1628140600609.png

 

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Thanks @Dmitriy 

Are you able to extract name and value fields from events?

 

index=alfa name="IIN" | stats count by value

 

Is this query working for you?

If Not can you please share sample _raw event, so I can help you on extraction also.

 

KV

 

0 Karma

Dmitriy
Explorer
index=alfa name="IIN" | stats count by value

result 0

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Dmitriy 

Can you please share the field name and sample data from index alfa ?

KV

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Dmitriy 

If you have same field name then you can try like this.

index = alfa
| lookup  IIN_oleg.csv IIN output IIN as IIN_1
| where isnotnull(IIN_1)

 KV

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...