Splunk Search

validate a value base on the lookup

frankyip
New Member

I have a csv lookup table like:
item, expression
a, "value>12 AND value<14"
b, "value=1"
c, "value!=111 "
d, "value<10 OR value>100"
....

And I have the log like:
2016-09-09 13:13:13, item=a, value=13
2016-09-09 13:13:14, item=b, value=131
2016-09-09 13:13:15, item=c, value=3
2016-09-09 13:13:16, item=d, value=1

I can lookup ouput a new field called expression base on the lookup table. And I want to validate if the value in each record matches the corresponding expression. Is it possible to do that?

Thanks

Tags (1)
0 Karma

sundareshr
Legend

Try this

base search | where [| inputlookup lookup.csv | eval search="item=\"".item."\" AND ".expression | fields search]
0 Karma
Get Updates on the Splunk Community!

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...