Splunk Search

Relative pattern matching

pmehta77
New Member

I am trying to do relative searches over multiple sources. I want to be able search source1 in source2 or vice versa to the closest match. For example
Source1:

Publisher Name Version
Microsoft SQL Server 2008
Microsft Office 2010

Source2:
Product
Microsoft SQL Server Common Files
Microsoft SQL Server 2012
Microsoft SQL Server 2008
Any help would be appreciated.

Tags (1)
0 Karma

micahkemp
Champion

There is a Levenshtein app for Splunk. It makes use of Levenshtein distance, which sounds like it may suit your needs.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's not clear what you hope to achieve. What do you mean by "relative pattern"? Given those two sources, what do you want the search results to be?

---
If this reply helps you, Karma would be appreciated.
0 Karma

pmehta77
New Member

Ok. Let me try to clarify it again. So i am looking for a relative match between , for example , IBM Tivoli Endpoint Manager and IBM Endpoint Manager. The reason its a relative match is because only one word
"Tivoli "is missing from name in source2. Similarly if i have Oracle JBEA Rocket in Source1 and Source2 has "BEA Rocket" that should be a close match. I hope that clarifies otherwise i will make another example. My personal thought was that i need to use a Fuzzy search mechanism or a cluster search that can bring out matching event types. But I am not sure how to apply that across multiple sources.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...