Splunk Search

Splunk search help -- output data should match sets of keywords

dantimola
Communicator

Hi, Fellow Splunkers,

Had post a question this past few days about matching 2 words or more ( https://answers.splunk.com/answers/577564/splunk-search-help-output-data-should-match-2-or-m.html), however, this case is working if you have to match 1 word only, my problem is that I have to match 3 sets of words for my output. For example:

case 1: Apple Banana Cupcake
case 2: foo1 foo2 foo3
case 3: food drinks people

Field = The Apple and Banana are fruit (matched word are in case 1: Apple and Banana)

Can I possibly do this in Splunk search? Thanks in advance.

Tags (3)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

not sure of "my problem is that I have to match 3 sets of words for my output",
but if the query words can be searched together..

  .....| rex "(?i)(?Apple|Banana|Cupcake|foo1|foo2|foo3|food|drinks|people)" max_match=0
| where mvcount(matchword)>1

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...