topic Re: How to match a partial string in search in Splunk Search

How to match a partial string in search

himanshu_b_shek — Tue, 16 Jul 2019 16:24:26 GMT

Hi,
I have a field called CommonName, sample value of CommonName are below:

CommonName = xyz.apac.ent.bhpbilliton.net
CommonName = xyz.ent.bhpbilliton.net
CommonName = xyz.emea.ent.bhpbilliton.net
CommonName = xyz.abc.ent.bhpbilliton.net

I want to match 2nd value ONLY I am using- CommonName like "%.ent.bhpbilliton.net", it gives all above-listed CommonName.
I want to select only 2nd one, Please advice here.

Thanks in advance.

Re: How to match a partial string in search

richgalloway — Tue, 16 Jul 2019 16:52:16 GMT

The % character in the match function matches everything. Since your four sample values all end with the string in your match they all match. To have a more specific matching pattern, you'll need to use a regular expression in the like function like this:

... | where like(CommonName, "^[^\.]+\.*\.ent\.bhpbilliton\.net") | ...

Re: How to match a partial string in search

Vijeta — Tue, 16 Jul 2019 17:05:24 GMT

You can use your query like this..

<your index search>| rex field=CommonName "\w+.(?<str>\w+.\w+.\w+)"| where str="ent.bhpbilliton.net"

Re: How to match a partial string in search

himanshu_b_shek — Tue, 16 Jul 2019 17:34:11 GMT

Thank you so much , it worked 🙂

Re: How to match a partial string in search

himanshu_b_shek — Wed, 30 Sep 2020 01:23:46 GMT

Hi ,
I am trying to use like this -
| eval access=if(((occurrences>1 OR Request_EMail like "dl-%@%.com" ) AND (Request_CommonName like "^[^.]+.*.ent.bhpbilliton.net") ) , "Grant" , "Reject")

But here it goes to access= "Reject" , how I can use this in eval .

Thank you