Splunk Search

Using Where like but instead of text looping through a lookup

kuroai
New Member

Hello!

I've been looking around for an answer to this one, either it eludes me or I'm straight up asking the wrong question.
I'm trying to create a hideous search utilizing the where like functions.

My search currently looks similar to this:

index="someindex" | lookup somelookup.csv LookupField as EventField output LookupField | search NOT LookupField=* | 
where like(EventField,"%ext") OR like(EventField,"t%xt") OR like(EventField,"te%t") OR like(EventField,"tex%") | further transforming etc

What I''m looking to achieve and make my life a little easier and potentially a better search all round is where the text within the like function is replaced with text brought in from a lookup, as far as i can tell this is not possible which means creating lots of similar searches .

If anyone can point me in the right direction that'd be grand or have another approach to this search.

Thanks in advance!

0 Karma

woodcock
Esteemed Legend

Try this:

index="someindex"
[|inputlookup YourLookupHere
| format "(" "like(" "OR" ")" "OR" ")"
| rex field=search mode=sed "s/=/,/g"]
0 Karma

grittonc
Contributor

Would a wildcard-based lookup from a lookup table work for you? You can save values like *test* in your lookup table and then define the lookup as matchtype WILDCARD. See this question for an example: https://answers.splunk.com/answers/52580/can-we-use-wildcard-characters-in-a-lookup-table.html.

You can do this either through the back end or in the GUI.

0 Karma

lakshman239
SplunkTrust
SplunkTrust

Have you tried 'replace' to replace the string? https://docs.splunk.com/Documentation/SplunkCloud/7.2.4/SearchReference/Replace

Also, you can use where match() to match a regex pattern to check.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...