Splunk Search

how to compare multiple fields

Tridi123
New Member

i have key words like project,plan ,lease
now if any file name if these key word hits i need to find which keywords have hitted.

if my file mane is Project_plan gamil.doc then keywords hitted are

project and plan.
Can anyone help what should be the Splunk query for this require ment

Tags (2)
0 Karma

yannK
Splunk Employee
Splunk Employee

After the search, use a regex extraction like rex or an eval function like match to check the presence of the keyword in the source field. And make correction for any case case sensitive matching.
Then you can have a field that will contain or not the matching.

example :


mysearch | rex field=source "(?(?i)(project))" | table _time found_project source _raw

OR

mysearch | eval source_lowercase=lower(source) | eval found_project=match(source_lowercase,project) | table _time found_project source _raw

0 Karma

Tridi123
New Member

suppose my filed is like contain both plan and project and i want my found_project column as project,plan what should i do
and the second query is not working as macth returns boolean only can u help once againg for this isssue??

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...