Splunk Search

Using match to see if a container begins with a string and setting a value as a result

SleepyGuy
Engager

I am trying to write a search query as part of our alerting.  The intention is that if search results come from a certain container (kubernetes.container_name) e.g. service1, service2 or service3 then I should set a priority of 2.

The problem is that the service names have a version number appended to them e.g. service1-v1-0 or service3-v3-0b to give two such examples.

My intention was to use a combination of 'if' and 'match' with a wildcard to achieve this but it doesn't seem to work.  The reason for me using this was that the start of the container_name would remain the same and as the version numbers change the search that I'm attempting to write should be future proofed.

| eval priority = if(match(kubernetes.container_name, "^service1-v*|^service2-v*|^service3*"), "2", "Not set")

However these are returning "Not set" even when the expected kubernetes.container_name is used.

Can someone help me understand why this isn't working, how to fix and whether there might be a better way of doing this?

Thanks!

Labels (1)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The match function uses regex so the wildcards are different - try this

| eval priority = if(match(kubernetes.container_name, "^service1-v.*|^service2-v.*|^service3.*"), "2", "Not set")
0 Karma
Get Updates on the Splunk Community!

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...

Enterprise Security Content Update (ESCU) | New Releases

In October, the Splunk Threat Research Team had one release of new security content via the Enterprise ...