topic Re: Is there a way to search where 4 letters in FieldA NotMatch FieldB? in Alerting

Is there a way to search where 4 letters in FieldA NotMatch FieldB?

aikn061 — Mon, 14 Nov 2022 18:54:32 GMT

Hi Guys,

So if I have two fields with really random set of text, no similarities except the red text. Does have the 'red' fonts in similarity as below.

In this case, is there a way to search to say when first four letters in FieldA exists in FieldB, exclude?

This would be very easy in powershell or python. I am medium splunk user as well, but not sure how I'd do this in splunk.

This would be very helpful.. Your help is appreciated in advance.

richgalloway — Tue, 15 Nov 2022 00:51:47 GMT

See if this helps.

| eval exclString=substr(FieldA, 1, 4) | where NOT match(FieldB, exclString)

EDIT: I fixed this answer to exclude rather than include matches. Thanks, @bowesmana !

bowesmana — Mon, 14 Nov 2022 22:29:30 GMT

Or the minimalist one liner 😃 - but turning round the logic to exclude rather than include those matching items

| where !match(FieldB, substr(FieldA, 1, 4))

aikn061 — Fri, 18 Nov 2022 19:24:55 GMT

Both methods do work - Thanks RichGalloway and Bowesmana

richgalloway — Fri, 18 Nov 2022 21:03:32 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.