Splunk Search

Using LOOKUP to insert a Regex string - is it possible?

ipicbc
Explorer

I want to insert a different regex string into my query for each host. I am thinking that a way to achieve this is by making a lookup into a CSV to retrieve the regex string, allocating to a new field, and then inserting it further on in the query.

Is this possible or ridiculous?

Thanks for your advice

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

That's entirely possible. Say your lookup looks like this:

host,expression
A,foo
B,bar

Add your lookup to your data as automatic, and search like this:

base search | where match(some_field, expression)

That would filter to only keep events where the host-based expression matches some_field.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

expression is the field produced by the automatic lookup.

0 Karma

ipicbc
Explorer

Thanks. How would I get the regex statement into expression?

0 Karma
Get Updates on the Splunk Community!

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...