Splunk Search

Wildcard lookup returns more than one value

bciancio
New Member

So I have a regex:

rex field=requestUrl "^\w+:\/\/[^\/]+\/(?<uri>.+)$"

And then I use the value of that in a lookup

lookup uri-operationName uri as uri, verb as httpMethod OUTPUTNEW operationName as operationName

Works great, most of the time. As you can see below, if I search for an operationName of "Get Tenders By Account ID" I get results with both operationNames.

uri verb operationName
service-name/accounts/* GET Get By Account ID
service-name/accounts/*/tenders GET Get Tenders By Account ID

How would I go about fixing that within either the regex, search or lookup?

0 Karma

bciancio
New Member
eval operationName=mvindex(operationName,0)

This appears to get the most specific match. If anyone has info about mvindex returning the most specific rex value in some official documentation, I'd appreciate it.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...