Splunk Search

comparing files

thinman
Explorer

Hi,

I have three files having similar information, namely: First Names, Second Names, Identification number, so I nedd to make a cross on then getting similar records by 1, 2 or 3 fields, the comparations should be more or less fuzzy.

This search is aim to find observed people.

There is a posibility splunk could do this job? What modules should be required.

Regards,

Julio

Tags (1)
0 Karma

sideview
SplunkTrust
SplunkTrust

I'm not at all sure that there's enough information here to answer your question but sometimes this is a sign that there's a really really simple answer. My apologies if this is completely off the mark.

Assuming the three files are all indexed, and they're indexed with different values for the 'source' field, and assuming source A has a field called 'firstname', source B has a field called secondname etc...

( source=A firstname="fred" ) OR (source=B secondname="fred") OR (source=C id="fred")

If it does, and you want the user to just have a single box that they type the 'fred' into, maybe you're looking to make a "form search" page that uses some similar search as its template.

http://www.splunk.com/base/Documentation/latest/Developer/FormIntro

sideview
SplunkTrust
SplunkTrust

Well then I think that's the right track for you, and you would populate the pulldown by configuring it with an internal search whose result rows were the observed people.

0 Karma

thinman
Explorer

Yes, I though something like that but soruce files are 1000 - 3000 records and "fred" shoudl be taked from the observed people list. This is for automatically relate a Anti-money Laundry list with client records.

Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...