Splunk Search

Is it possible to match partial results against a lookup table?

jambajuice
Communicator

Assume I have an event with the following field:

Name="Microsoft Office Outlook MUI (English) 2007"

Assume I have a lookup table as follows:

Vendor,Product,Version Microsoft Corporation,Outlook,2007 SP1

If the Name field does not consistently adhere to the format of the lookup table, is it possible to do a lookup that would do a partial match against the fields of the lookup table? So if the Name field contains Microsoft, Outlook, and 2007 it would match?

Thx.

Craig

Tags (1)

lguinn2
Legend

Yes, it is possible now! There is a great answer given by Jason to this question:

How are values in lookups matched?

chris
Motivator

Right now this is not possible out of the box with csv files. The match must be exact.

Have a look at:
http://answers.splunk.com/questions/718/how-are-values-in-lookups-matched
http://answers.splunk.com/questions/5916/using-cidr-in-a-lookup-table

You can write your own lookup script that will do the correct less sensitive matching:
http://www.splunk.com/base/Documentation/4.1.6/Knowledge/Addfieldsfromexternaldatasources

hazekamp
Builder

Be sure to use the LOOKUP- property! Does anyone know if the "lookup" search command is case sensitive/insensitive by default?

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

it's possible to make the match case-insensitive, but that's currently all. other than that, the match must be exact, not partial.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...