topic Re: LIKE() with wildcard within an IF statement in Dashboards & Visualizations

LIKE() with wildcard within an IF statement

Tisiphone_1 — Fri, 13 Aug 2010 06:09:02 GMT

Can anybody tell me why this LIKE statement using a wildcard errors out within an IF statement in a form search, but not in the standard search box?

Here's the whole form search:

   <searchTemplate>
   index=test
   [stats count | eval search=(

           if("$VAR$"=="empty"," "," | where like(field,%$VAR$%) ")

   ) 

   | fields - count ]
   </searchTemplate>

The part that never works is the LIKE statement % (the search wildcard):

| where like(field,%$VAR$%)

I have tried using ASCII instead of symbol %, and quotes in different places. The error I receive is: "Error in 'eval' command: Typechecking failed. '%' only takes numbers."

However, in standard search,:

| where like(field,%stuff%)

works just fine.

FYI: I am using 4.0.11 - it appears LIKE may function differently than newer versions.

Re: LIKE() with wildcard within an IF statement

Johnvey — Fri, 13 Aug 2010 12:37:16 GMT

Can you clarify what the output of the search should be? It appears that you're trying to generate SQL-like search syntax within the search language -- there probably is a simpler way to achieve what you want.

Re: LIKE() with wildcard within an IF statement

Stephen_Sorkin — Fri, 13 Aug 2010 22:34:45 GMT

Eval and where require that the pattern for a LIKE expression be a string literal. Your syntax should be | where like(field,"%stuff%"). I think that it's working in some of the cases because the UI is injecting quotes (where they don't necessarily belong).

Re: LIKE() with wildcard within an IF statement

Tisiphone_1 — Sat, 14 Aug 2010 03:42:39 GMT

I'm letting a user put a string into a search box, and if the search box is not empty I am searching for things that contain that string.

Re: LIKE() with wildcard within an IF statement

Tisiphone_1 — Sat, 14 Aug 2010 03:43:29 GMT

I have tried both " and ". Both produce an error.

Re: LIKE() with wildcard within an IF statement

jrodman — Thu, 19 Aug 2010 15:45:26 GMT

If you paste this search into the Summary view of search, does it seem to land in the flash timeline intact?

Re: LIKE() with wildcard within an IF statement

jetie — Fri, 03 Jan 2014 14:13:22 GMT

oiResult=failure | where like(oiErrorString, "%5 - invalid truck number DSN%")

Works for me with version 6.0

Re: LIKE() with wildcard within an IF statement

kartik13 — Fri, 24 Jun 2016 03:47:23 GMT

I know its too late to reply but not too late to contribute.
I am working on same kind of thing here my query which worked for me .

|where like(label,"%"+"$Token_Name$"+"%") OR like(label,"%"+"$Token_Name_part$"+"%")

Re: LIKE() with wildcard within an IF statement

rey123 — Wed, 03 Jul 2019 17:01:03 GMT

The above syntax of including "%" in a separate set of quotes from the token, did not work for me. After a lot of trial and error, what worked was this, ie., encapsulating the "%" within the SAME SET of quotes as the token:

| where like(label,"%$Token_Name$%")