Splunk Search

How to adjust search to include names that are also hyphenated

dougsummersett
New Member

We ingest patient records into Splunk and some compliance users need to search to see if an employee accessed records of family members. We create a report that shows any employee that accesses a record that exactly matches their last name. This will not match any patients that might be hyphenated or apostrophe.

How can I adjust my search to make it not an exact match but if it contains the same value?

0 Karma

woodcock
Esteemed Legend

Here is a run-anywhere search that proves that hyphenated searches do work:

index=_* AND "data.instance_guid"="*-*-*-*-*"

Are you saying that one of your datasets has stripped the hyphens and apostrophes from the dataset so you need to normalize one side or the other to do the search?

0 Karma

aberkow
Builder

Hi - I played around with a bunch of the options from here: https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/ConditionalFunctions#match.28SUBJ...

And got the below code to work -

{code}
| makeresults count=1
| streamstats count
| eval Name2 = "Name2"
| eval hyphenNameThatShouldMatch=case(count=1, "Name1-Name2")
| eval hyphenNameThatShouldntMatch=case(count=1, "Name3-Name4")
| eval match=case(like(hyphenNameThatShouldMatch,"%".Name2."%"), 1)
| eval shouldntMatch=case(like(hyphenNameThatShouldntMatch,"%".Name2."%"), 1)
| table Name2, hyphenNameThatShouldMatch, match, hyphenNameThatShouldntMatch, shouldntMatch
{code}

Basically, you asked Splunk to return a bool for whether there was a "like" regex match for the name with wildcards on each side, you can trim this if you know things like where the pattern should match more accurately.

Hope this helps!

0 Karma

oscar84x
Contributor

Could you share your search as well a sample event or just the field containing the value you're searching for?

0 Karma

dougsummersett
New Member

Here is the search we are using to match the user and patient's last names.

index="clinical_applications" sourcetype=app | eval USER_NAME=split(USER_NAME,",") | eval USER_NAME_LAST=mvindex(USER_NAME,0) | eval USER_NAME_FIRST=mvindex(USER_NAME,1) | eval PATIENT_LAST_NAME=upper(PATIENT_LAST_NAME) | eval PATIENT_FIRST_NAME=upper(PATIENT_FIRST_NAME) | where PATIENT_LAST_NAME = USER_NAME_LAST | strcat PATIENT_FIRST_NAME " " PATIENT_LAST_NAME PATIENT_NAME | convert ctime(_time) as Time | rename EPIC_ENTERPRISE_MRN_ID as MRN_ID | rename METRIC_DESCRIPTION as ACTION | table Time,USER_NAME,WORKSTATION,PATIENT_NAME,MRN_ID,ENVIRONMENT,ACTION

0 Karma

dougsummersett
New Member

In this search, we split the user_name field into first and last name then convert to upper case then compare the user last name and patient last name. After that we make it pretty for the users to read.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...