topic Re: How to search a field which contain text from another field? in Splunk Search

How to search a field which contain text from another field?

dordavid — Tue, 17 Nov 2020 11:16:58 GMT

Hey, i want to search a field and get all the results which contain a value from another field.

For example: I have 2 fields: message and str.

I want to get all the logs which their message field contain the value of str field.

how can i do that?

Re: How to search a field which contain text from another field?

gcusello — Tue, 17 Nov 2020 11:27:54 GMT

Hi @dordavid,

let me understand:

you have two searches,
you want to filter the results of search_1 where a field of search_2 is present.

Only one question: do you want to match field from search 2 with only one field from search_1 or in all the _raw?

In the second case you can use the following search:

your_search_1 [ search your_search_2 | rename field_2 AS query | fields query ] | ...

in the first case (if field_1 is the field in the search_1 and field_2 is the field in search_2), try something like this:

your_search_1 [ search your_search_2 | eval field_1="*".field_2."*" | fields field_1 ] | ...

In this second case the fields in main search and subsearch must have the same name (case sensitive).

Ciao.

Giuseppe

Re: How to search a field which contain text from another field?

dordavid — Tue, 17 Nov 2020 11:59:34 GMT

i will give u an example:

i have a two fields:
1) message
2) str

- lets assume that str contains the string "high cpu".

- i want to search all the logs which their message field contain the value of str: all the logs which their message field contain "high cpu".

-i want to do it dynamically - something like that:
index = a | search message= {str}* // all logs with message field which contain the content of str field

Re: How to search a field which contain text from another field?

inventsekar — Tue, 17 Nov 2020 12:32:46 GMT

Hi @dordavid ... From the post -

https://community.splunk.com/t5/Splunk-Search/How-to-check-if-a-field-contains-a-value-of-another-field/m-p/247843

your search | eval result=if(like(field2,"%".field1."%"),"Contained","Not Contained")

| where match(field2,field1)

Re: How to search a field which contain text from another field?

gcusello — Tue, 17 Nov 2020 13:32:38 GMT

Hi @dordavid,

try my first solution or the solution by @inventsekar that's equivalent.

Ciao.

Giuseppe