This app allows you to apply fuzzy logic to lookups from your search result fields for near-matches. Use cases include:
search | fuzzylookup
[ prefix=<string> ]
[ addmetrics=[True|False] ]
[ lookupfilter=<kvpairs> ]
[ mask=<regex> ]
[ delete=<regex> ]
<lookup-table-name>
( <lookup-field> [AS <event-field>] )
[ OUTPUT | OUTPUTNEW (<lookup-destfield> [AS <event-destfield>] ) ... ]
Cross-reference your search fields against lookup data for non-exact matches, with the fields from the lookup entry/entries with the best score being appended to the event.
lookupfilter="LookupField1=\"local admin\" Lookupfield2=\"*@$email_domain$\""
delete="(@[^@]+$|\\.|_)" mask="[0-9]"
Syntax: prefix=<prefix_text>
Description: Text to prefix all output field names with. Helpful for applying to every lookup field without aliasing each one.
Syntax: addmetrics=[True|False]
Description: Add fuzzy match metrics to each result (score, matching characters, similarity score, consecutive match length).
Default: False
Syntax: lookupfilter="<lookup_field>=\"lookup_value\" <lookup_field>=\"$event_field$\""
Description: Filter for data in the specified lookup to reduce the number of comparisons
Syntax: mask="<regular expression>"
Description: Mask pattern for both compared sets of values. Masks the regex matched text before comparing.
Syntax: delete="<regular expression>"
Description: Deletion pattern for both compared sets of values. Removes the regex matched text before comparing.
Having trouble with the app? Feel free to email us and we’ll help you sort it out. You can also reach the author on the Splunk Community Slack.
We love hearing your feedback and ideas for our apps. Please email your suggestions!
Check out our blog article on the topic: Gettin' Fuzzy With It.
Updated Splunk SDK
Removed custom logging.conf file, resolving a Splunkbase compliance issue.
Resolved an issue where the app was not working under Windows.
Bug fix for addmetrics option
Initial release.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.