Splunk Search

Lookup table to many search queries

Accak
Path Finder

I have lookup table like this:

locationOrFunction, asset_id
London,Application for one;Application for two;Application for three;Appfor HR 
Jakarta,Application for one
Lausanne, Application for two;LBPF*;Application for three;
Monako, Application for *

I want to get something like this:

locationOrFunction, asset_id
London, "Application for one" OR "Application for two" OR "Application for three" OR "Appfor HR" 
Jakarta, "Application for one"
Lausanne, "Application for two" OR "LBPF*" "Application for three"
Monako, "Application for *"

OR

 locationOrFunction, asset_id
    London, asset_id="Application for one" OR asset_id="Application for two" OR asset_id= "Application for three" OR asset_id="Appfor HR" 
    Jakarta, asset_id="Application for one"
    Lausanne, asset_id="Application for two" OR asset_id="LBPF*" asset_id="Application for three"
    Monako, "asset_id=Application for *"

I want to use it in multiselect input.
I tried with format, but it gets all rows (combine all locations), what I want to get is search queries for all independently.
Probably regex will be the answer, but I can't figure it out by myself. Any ideas?

0 Karma
1 Solution

Accak
Path Finder

I managed to do it:

 | inputlookup Asset_id_sorted_by_category.csv | eval asset_id = split(asset_id, ";")| rex field=asset_id mode=sed "s/$/\"/" | rex field=asset_id mode=sed  "s/^/ OR asset_id=\"/" | nomv asset_id | rex field=asset_id mode=sed  "s/OR//" |table asset_id, locationOrFunction

View solution in original post

0 Karma

Accak
Path Finder

I managed to do it:

 | inputlookup Asset_id_sorted_by_category.csv | eval asset_id = split(asset_id, ";")| rex field=asset_id mode=sed "s/$/\"/" | rex field=asset_id mode=sed  "s/^/ OR asset_id=\"/" | nomv asset_id | rex field=asset_id mode=sed  "s/OR//" |table asset_id, locationOrFunction
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...