topic check if stringa in stingb in Splunk Search

check if stringa in stingb

mcohen13 — Sun, 19 Aug 2018 10:50:31 GMT

how can i make a case condition to check if StingA is in StringB?

for example StingA is "xxx.com." StingB is: "a.xxx.com."

Re: check if stringa in stingb

jkat54 — Sun, 19 Aug 2018 11:28:41 GMT

Try this:

... | eval match=if(like(fieldB,fieldA),1,0) | search match=1

Re: check if stringa in stingb

mcohen13 — Mon, 20 Aug 2018 06:36:16 GMT

if the list of domains are not in a field but in a lookup table, how does that change the query?

for example:
i have a list of domain in a lookup table
and i have a list of domain in a field

and i want to check if the list of domains in the field are in the lookup table

Re: check if stringa in stingb

jkat54 — Mon, 20 Aug 2018 11:38:44 GMT

In that case...

... | rename domain as domainFromIndex 
| inputlookup lookupName domain as domain OUTPUTNEW domainFromLookup
| eval match=if(domainFromIndex=domainFromLookup,1,0)
| where match=1