Splunk Search

Is it possible to use match in an initial search execution?

nick405060
Motivator

Hey guys

So I would like to have a search select events from myindex based on what the user selects in a multiselect.

One way that I can think to do this is to do:

index=myindex ("some raw string that option1 represents ending in a space " AND match($multiselect$,"option1")) OR ("some raw string that option2 represents not ending in a space" AND match($multiselect$,"option2"))  OR ("some raw string that option3 represents ending in a space " AND match($multiselect$,"option3"))

However this option does not work. You cannot do a match in the initial search execution, as far as I can tell. Is this correct? I tried just index=myindex AND match("asdf","asdf") | head 1 and that doesn't work. I could eval temp="$multiselect$" and then match(temp,"option1") however that is not an elegant solution. I want to search for the strings during the initial search because that time complexity is exponentially better. Also I can't use valuePrefix/delimiter because the searched strings end in a white space per https://answers.splunk.com/answers/750199/how-can-i-include-a-trailing-whitespace-in-a-multi.html

Thoughts?

0 Karma

maciep
Champion

if i add the space in the simple xml, it seems to honor it? See the valueSuffix below. When i went back to the gui, it kept the space.

<input type="multiselect" token="field1">
  <label>field1</label>
  <choice value="some raw text option1">option 1</choice>
  <choice value="some raw text option 2">option2</choice>
  <prefix>(</prefix>
  <suffix>)</suffix>
  <valuePrefix>"</valuePrefix>
  <valueSuffix> "</valueSuffix>
  <delimiter> OR </delimiter>
</input>
0 Karma

nick405060
Motivator

but not every value ends in a space. so I can't just add the suffix for all.

0 Karma

maciep
Champion

ah...rtfm...got it.

0 Karma

nick405060
Motivator

rtfm? there is zero in documentation about either question

0 Karma

maciep
Champion

oh sorry, that was a reference to me not reading your question closely ("read the f'ing manual").

how about including the quotes in the values instead of the prefix suffix?

   <input type="multiselect" token="field1">
      <label>field1</label>
      <choice value="&quot;some raw text option &quot;">option 1</choice>
      <choice value="&quot;some raw text option&quot;">option2</choice>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix></valuePrefix>
      <valueSuffix></valueSuffix>
      <delimiter> OR </delimiter>
    </input>
0 Karma

nick405060
Motivator

Still dumps the white space.

0 Karma

nick405060
Motivator

o cool. will try tomorrow AM thx!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...