Splunk Search

Return the closest match for a wildcard lookup

Influencer

I have a lookup 3 wildcard fields. What I want to be able to do is to only return the closes match, so if there are multiple matches, pick the closest one, e.g. if I have the following 3 rows in the lookup

F1, F2, F3, O1
test,,field3,output1
test,field
,field3,output2
test,f*,field3,output3

and with the following data

F1=test
F2=field2
F3=field3

lookup F1,F2,F3 OUTPUT O1

I want O1 to be output2, i.e. from the second match as the length of the match string for F2 is the longest of the 3 possibilities. max_matches can't be 1 as that does not work on closest match and also, as this is KV store, I have some fields (F3) that is a multi value field, so using max_matches = 1 will also effectively remove all bar 1 of the multi value entries in F3.

Can this be done with the lookup itself or will it need post processing - and if so, how could that be done with post processing?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!