Splunk Search

Wildcard lookup returns more than one value

bciancio
New Member

So I have a regex:

rex field=requestUrl "^\w+:\/\/[^\/]+\/(?<uri>.+)$"

And then I use the value of that in a lookup

lookup uri-operationName uri as uri, verb as httpMethod OUTPUTNEW operationName as operationName

Works great, most of the time. As you can see below, if I search for an operationName of "Get Tenders By Account ID" I get results with both operationNames.

uri verb operationName
service-name/accounts/* GET Get By Account ID
service-name/accounts/*/tenders GET Get Tenders By Account ID

How would I go about fixing that within either the regex, search or lookup?

0 Karma

bciancio
New Member
eval operationName=mvindex(operationName,0)

This appears to get the most specific match. If anyone has info about mvindex returning the most specific rex value in some official documentation, I'd appreciate it.

0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...