topic Re: can i use "like" in search criteria in Splunk Search

can i use "like" in search criteria

alexl1 — Tue, 09 Jul 2013 17:34:21 GMT

if one of my fields is host, I want to do

host like "startswith*"

what is the syntax to do that? thanks,

Re: can i use "like" in search criteria

JSapienza — Tue, 09 Jul 2013 17:42:10 GMT

Here are are a couple ways.

host=foo*
... | where like(host, "foo%")

Re: can i use "like" in search criteria

alexl1 — Tue, 09 Jul 2013 17:48:54 GMT

thanks! ...

Re: can i use "like" in search criteria

bcherdak — Sun, 03 Jul 2016 12:14:59 GMT

What is the best way to exclude event that start with foo*?

Re: can i use "like" in search criteria

ddrillic — Sun, 03 Jul 2016 20:39:41 GMT

-- bcherdak, you asked - "What is the best way to exclude event that start with foo*?"

I would say - ... NOT host = "foo*"

Re: can i use "like" in search criteria

jtacy — Mon, 04 Jul 2016 03:48:04 GMT

While it's probably safe to use NOT host="foo*" since the host field should always exist, I'd favor the host!="foo*" syntax; if you have a pattern you're matching on, you probably expect that field to exist in the results. Using the NOT approach will also return events that are missing the field which is probably not what most people want.

Re: can i use "like" in search criteria

jtacy — Tue, 29 Sep 2020 10:08:02 GMT

If you want to exclude events where a field doesn't start with foo*, use field!="foo*".

If you want to exclude events where the event itself doesn't start with foo*, you can use _raw!="foo*".

Re: can i use "like" in search criteria

th1agarajan — Thu, 03 May 2018 16:24:04 GMT

@bcherdak : What is the best way to exclude event that start with foo*?

your search | where NOT like(host,"foo%")

This should do the magic.

Re: can i use "like" in search criteria

pranjal — Tue, 29 Sep 2020 23:16:10 GMT

whats the best way to compare with a list of items.
I am looking for something like this:
|search where NotificationEventType in ("THE_CHEESEBURGER%", "THE_HAMBURGER%", "ETC%"...)

Re: can i use "like" in search criteria

pranjal — Tue, 29 Sep 2020 23:16:13 GMT

whats the best way to compare with a list of items.
I am looking for something like this:
|search where NotificationEventType in ("THE_CHEESEBURGER%", "THE_HAMBURGER%", "ETC%"...)