Search 2 tables with limited characters

[VipeRafajzat]

Hi All,

I would like to search for a specific 7 character length of data from 2 tables. Within these 2 tables I have multiple data length, so it varies from 1 to 20, but I need only those which are exactly 7 digits/characters long.

After I  filtered for these 7 digits from these 2 tables, I would like to put them into a common name/ID which I can use for my lookup.

Do you have any idea how can I do it and use with the above lookup?

The lookup search what I am using is:

index=myindex| lookup my_lookup field1 OUTPUTNEW mylookup_name | eval field1=IF(ISNULL(mylookup_name),field1,field2) | rename field1 as "NAME" | chart count by "NAME" | sort -count

Do you have any idea how can I do it and use with the above lookup?

[Richfez]

Well, I have some ideas but you never mention *which* field you want the length of (and to limit to ones that are 7 characters). 

Anyway, no worries, it's just a single eval to get the length, and you can search again after you make that eval if you want to filter it down to just ones of length 7.

The eval to create a new field called 'fieldLength', which contains the number of characters in the field "fieldX"

| eval fieldLength=len(<fieldX>)

I recommend adding that and checking that it does what you want (which probably means you want to drop the "chart" command off temporarily).

If you want to filter it to the ones that are length 7, easily enough you'd just do like the above only add a line to search.

| eval fieldLength=len(<fieldX>)
| search fieldLength = 7

You'll have to modify it to fit your fields, but that's about all it should take.

Happy Splunking!

-Rich

[VipeRafajzat · Accepted solution]

Hi Rich,

Thanks for your reply. What I did and solve my problem is the following based on your suggestion:

| eval XY = mvappend(field1, field2) | where len(xy_number)=7 

Thank you!