topic How to match portion of string between two fields in splunk in Splunk Search

How to match portion of string between two fields in splunk

obais9346 — Fri, 07 May 2021 21:45:47 GMT

Example:

field1=ADOBE INC.

field2=ADOBE SYSTEMS&sep1; INCORPORATED

i want to match this as both fields containing "ADOBE" in string, i am a advanced beginner to splunk

i have tried below condition in my splunk search but no luck(did not work)

..........| eval results= if(like(field1,"%".field2."%"),"Yes","No")

Please help and it is appreciated.

Thank You:)

ITWhisperer — Fri, 07 May 2021 22:52:50 GMT

You won't get a match because field2 does not exist in field1, but also field1 doesn't exist in field2, but if field1 was just "ADOBE" it would match

| makeresults | eval field1="ADOBE" | eval field2="ADOBE SYSTEMS INCORPORATED" | eval result=if(like(field2,"%".field1."%"),"Yes","No")

obais9346 — Fri, 07 May 2021 23:12:19 GMT

Thanks for making me understand

But my requirement is to match

field1=ADOBE INC.

field2=ADOBE SYSTEMS&sep1; INCORPORATED

How do i achieve this?

thanks in advance!

ITWhisperer — Sat, 08 May 2021 06:40:24 GMT

Are you expecting these to fields to appear equal in some way? If so, what criterion do you want to use to say that they are equal?