topic Re: Using like() not working in where statement in Splunk Search

Using like() not working in where statement

bpna — Wed, 28 Apr 2021 21:20:12 GMT

I have an alerts index which has a data.rule.name field containing the following values:

COVID-19 linked Cyber Attacks (Social Media)	2	40%
Global Trends, Trending Targets	1	20%
Locations by Risk Level	1	20%
Target Trends, Trending Targets in Watch List	1	20%

I would like to filter events to only include ones where data.rule.name begins with "Target Trends..."

My SPL is as follows:

index=alerts
| where like(data.rule.name, "Target Trends.%")

This produces 0 events. Am I using this function wrong?

Re: Using like() not working in where statement

bpna — Wed, 28 Apr 2021 21:29:09 GMT

I was able to solve this by putting the condition in the first line of the search, like this:

index=alerts data.rule.name="Target Trends, Trending Targets in Watch List"

It still bugs me that

| where like()

isn't working the way I'd expect it to, if anyone has advice I am all ears!

Re: Using like() not working in where statement

bowesmana — Wed, 28 Apr 2021 22:28:07 GMT

@bpna

When using field names in statements that take an eval expression, like the where clause does, you will need to escape fields that do not contain 'simple' characters. In practice this means that any field starting with a numeric, or not contain only numbers and letters will need to be escaped by wrapping the field in single quotes, e.g.

| where like('data.rule.name', "Target Trends.%")

in this case, the . character needs to be escaped. See these links for a description (although they are SLP2, they apply here also)

https://docs.splunk.com/Documentation/SCS/current/Search/Escapecharacters#Rules_for_when_to_use_escape_characters

https://docs.splunk.com/Documentation/SCS/current/Search/Quotations