Splunk Search

Lookup table to many search queries

Accak
Path Finder

I have lookup table like this:

locationOrFunction, asset_id
London,Application for one;Application for two;Application for three;Appfor HR 
Jakarta,Application for one
Lausanne, Application for two;LBPF*;Application for three;
Monako, Application for *

I want to get something like this:

locationOrFunction, asset_id
London, "Application for one" OR "Application for two" OR "Application for three" OR "Appfor HR" 
Jakarta, "Application for one"
Lausanne, "Application for two" OR "LBPF*" "Application for three"
Monako, "Application for *"

OR

 locationOrFunction, asset_id
    London, asset_id="Application for one" OR asset_id="Application for two" OR asset_id= "Application for three" OR asset_id="Appfor HR" 
    Jakarta, asset_id="Application for one"
    Lausanne, asset_id="Application for two" OR asset_id="LBPF*" asset_id="Application for three"
    Monako, "asset_id=Application for *"

I want to use it in multiselect input.
I tried with format, but it gets all rows (combine all locations), what I want to get is search queries for all independently.
Probably regex will be the answer, but I can't figure it out by myself. Any ideas?

0 Karma
1 Solution

Accak
Path Finder

I managed to do it:

 | inputlookup Asset_id_sorted_by_category.csv | eval asset_id = split(asset_id, ";")| rex field=asset_id mode=sed "s/$/\"/" | rex field=asset_id mode=sed  "s/^/ OR asset_id=\"/" | nomv asset_id | rex field=asset_id mode=sed  "s/OR//" |table asset_id, locationOrFunction

View solution in original post

0 Karma

Accak
Path Finder

I managed to do it:

 | inputlookup Asset_id_sorted_by_category.csv | eval asset_id = split(asset_id, ";")| rex field=asset_id mode=sed "s/$/\"/" | rex field=asset_id mode=sed  "s/^/ OR asset_id=\"/" | nomv asset_id | rex field=asset_id mode=sed  "s/OR//" |table asset_id, locationOrFunction
0 Karma
Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...