Splunk Search

comparing selected bytes from two values

zuzgon2
Engager

Hey,
I got a few indexes in splunk and I want to compare two different values
but like the first 10bytes of the first value and the last 10bytes of the second value.
Like if it's
search (index1 or index2) | where value1[0:10]=value2[-10::]
value1=0123456789hiiiiiiiiiiiiiiiii
value2=hiiiiiiiiii0123456789
will return true.

Tags (3)
0 Karma

Ayn
Legend

You can use the substr function.

(index=index1 OR index=index2) | where substr(value1,1,10)==substr(value2,-10)

Note that it's VERY inefficient to use a base search without any filtering like this. If possible you should try to find ways to filter how much data comes out of the base search.

http://docs.splunk.com/Documentation/Splunk/6.1.1/SearchReference/CommonEvalFunctions

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Take a look at this:

| stats count | eval value1="0123456789hiiiiiiiiiiiiiiiii" | eval value2="hiiiiiiiiii0123456789" | eval match = if(substr(value1, 0, 10) == substr(value2, -10, 10), "match", "no match")

Gives me "match".

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...