Splunk Search

How do i find out if a field contains part of another field?

sgrierson
New Member

Hello community.

I'm struggling to find emails that have a word in the subject which also have the word in an attachment.

For example:
If an email subject was "X.Y:Z" and then also have an attachment of "Z.doc"

As you see, I need to find an attachment that begins with the word that is the end of the subject.

So if...
Subject="card.parrot:bacon"
Then the attachment would be...
Attachment="bacon.doc"

Would such a thing be possible?

I hope this makes sense.
Thanks for your time.

0 Karma

woodcock
Esteemed Legend

Like this:

|makeresults
| eval subject = "X.Y:Z", attachment = "Z.doc"
| rex field=subject "(?<stest>\w+$)"
| rex field=attachment "^(?<atest>\w+)"
| where atest == stesta
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There probably are a few ways to do this. Here's one. It uses rex to parse the subject field and extract whatever follows ":" into the Attachment field. Then ".doc" is appended to the field.

... | rex field=Subject ":(?<Attachment>.*)" | eval Attachment = Attachment.".doc"
---
If this reply helps you, Karma would be appreciated.
0 Karma

sgrierson
New Member

Afraid this was showing errors

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What errors?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...