Splunk Search

Return the closest match for a wildcard lookup

bowesmana
SplunkTrust
SplunkTrust

I have a lookup 3 wildcard fields. What I want to be able to do is to only return the closes match, so if there are multiple matches, pick the closest one, e.g. if I have the following 3 rows in the lookup

F1, F2, F3, O1
test,,field3,output1
test,field
,field3,output2
test,f*,field3,output3

and with the following data

F1=test
F2=field2
F3=field3

lookup F1,F2,F3 OUTPUT O1

I want O1 to be output2, i.e. from the second match as the length of the match string for F2 is the longest of the 3 possibilities. max_matches can't be 1 as that does not work on closest match and also, as this is KV store, I have some fields (F3) that is a multi value field, so using max_matches = 1 will also effectively remove all bar 1 of the multi value entries in F3.

Can this be done with the lookup itself or will it need post processing - and if so, how could that be done with post processing?

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...