topic Re: LIKE and like() in Splunk Enterprise Security

LIKE and like()

ak1508 — Wed, 11 Dec 2019 10:11:20 GMT

Just want to clear this up so I am not mistaken. Are the two statements equivalent:

 | where like (foo, "bar")

and

| where foo LIKE "bar"

In my test setup I am getting the same search results, I'm wondering if there is anything different on the backend that Splunk does. From the Job inspector it seems they both run the same Optimized search of the first option. Should this be the preferred syntax?

Thanks

Re: LIKE and like()

jawaharas — Mon, 20 Jan 2020 06:18:37 GMT

As per Splunk Docs, below syntax seems preferred.

 .. | where like (foo, "bar")

Re: LIKE and like()

niketn — Mon, 20 Jan 2020 09:17:22 GMT

@ak1508 as per color coding for SPL post Splunk 6.5, the like in the command | where foo like "bar" is an argument as it highlights as orange, but using | where like(foo,"bar") treats it as function and highlights as pink. Refer to Splunk Documentation for the same: https://docs.splunk.com/Documentation/Splunk/latest/Search/Parsingsearches#Color_codes

You should be using the second one because internally Splunk's Query Optimization converts the same to function like().

Which implies following query in Splunk Search

| makeresults
| eval data="testabc"
| where data like "test%"

Converts to the following optimized query when it executes (you can check Job Inspector for details:

 | makeresults 
 | eval data="testabc" 
 | where like(data,"test%")