Hi Community - I'm trying to extend the Levenshtein distance query in this tutorial: https://www.splunk.com/en_us/blog/tips-and-tricks/you-can-t-hyde-from-dr-levenshtein-when-you-use-ur....
Specifically, I'm trying to evaluate the Levenshtein distance of an email domain against multiple comparison domains on one line, with the resulting values going into a multivalue field. I tried doing this with mvmap:
| eval lev=mvmap(inspect_domains, `ut_levenshtein(ut_domain, inspect_domains)`)
Where inspect_domains is the multivalue field containing comparative domains, and ut_levenshtein is a search macro in the URL Toolbox app .
This returns an error: "Error in 'eval' command: The expression is malformed. Expected ). "
To my eye, the parentheses appear to be balanced. I nevertheless tried adding or removing parentheses to try to make Splunk happy, but no combination of parentheses seems to work
I don't think mvmap is going to work in that context based on the contents of that specific macro.
Can you give this SPL a shot? It's not one line, but it's close and should still get you where you need to go. Unless there is a specific reason it needs to be a one-liner.
| makeresults | eval ut_domain="mycampany.com" | append [| makeresults | eval ut_domain="mycempany.com" ] | mvcombine ut_domain | eval company_domain ="mycompany.com" | fields - _time | mvexpand ut_domain |`ut_levenshtein(company_domain, ut_domain)`
Thank you for taking the time to respond. That didn't quite work, but it gave me the idea for a rough solution: by using mvappend to join together all of the email domains I want to inspect against, followed immediately by an mvexpand to generate separate line items per event per domain, I can run the ut_levenshtein macro against everything.
| eval inspect_domains=mvappend("yahoo.com", "google.com", "outlook.com")
| mvexpand inspect_domains
| `ut_levenshtein(sender_domain, inspect_domains)`
Not very elegant and may not scale, but it works well enough for now. Thanks again.