i have key words like project,plan ,lease
now if any file name if these key word hits i need to find which keywords have hitted.
if my file mane is Project_plan gamil.doc then keywords hitted are
project and plan.
Can anyone help what should be the Splunk query for this require ment
After the search, use a regex extraction like rex
or an eval function like match
to check the presence of the keyword in the source field. And make correction for any case case sensitive matching.
Then you can have a field that will contain or not the matching.
example :
mysearch | rex field=source "(?(?i)(project))" | table _time found_project source _raw
mysearch | eval source_lowercase=lower(source) | eval found_project=match(source_lowercase,project) | table _time found_project source _raw
suppose my filed is like contain both plan and project and i want my found_project column as project,plan what should i do
and the second query is not working as macth returns boolean only can u help once againg for this isssue??