Splunk Search

Using Lookups in Splunk with CASE statements

JuhiSaxena
Explorer

I am using CASE statements to evaluate value of msgcode variable below. Can this set of CASE-like statements be replaced with a lookup in Splunk?

eval msgcode=CASE(Error LIKE "%Not a valid path to a statistics probe%","1", Error LIKE "%invalid message size%maximum size expected was%","1",Error LIKE "%eartbeat manager is disconnecting an unresponsive%","1",Error LIKE "%attempted to publish a message larger than the sow store slab size size and the processing of that message has been aborted%","1", Error LIKE "%sow%error%","1",Error LIKE "%transaction log unable to execute journal action%","1",Error LIKE "%client reaper detected a client which has not been reaped %","1",Error LIKE "%HTTP interface to statistics is currently unavailable%","1",Error LIKE "%waiting for %to complete%","1",Error LIKE "%Failed to parse the query string%","1",Error LIKE "%" ,"0") | eval Time=strftime(_time, "%m/%d %H:%M:%S") | table Time,Error,host,sourcetype,count,msgcode | dedup Time,Error,host,sourcetype,count,msgcode | eval trigger=CASE (msgcode==0, "yes", msgcode==1 AND count>=3,"yes",msgcode==1 AND count<3,"no") | where trigger="yes"

0 Karma

koshyk
Super Champion

If using front-end UI Search
I'm not aware of match options within a lookup.

**If using backend conf **
If you are using "conf" files You could do completely avoid eval-CASE to a certain based based on lookup file with normal lookup and/or wildcard lookup (MATCH_TYPE). But this is NOT possible to avoid a value in between the string,

In Summary, i don't think you can avoid CASE statement that easily as per your example strings.

0 Karma

starcher
SplunkTrust
SplunkTrust
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...