https://community.splunk.com/t5/Splunk-Search/Eval-Substring-Match/m-p/567508#M197780 <P>Use match not like</P><LI-CODE lang="markup">| makeresults | eval field1="http://www.yahoo.com/mail/inbox" | eval field2="yahoo" | eval field3="linkedin.com/company/google/profile" | eval field4="google" | eval comparison1 = if(match(field1, field2), "1", "0") | eval comparison2 = if(match(field3, field4), "1", "0") | eval comparison3 = if(match(field1, field4), "1", "0") | eval comparison4 = if(match(field3, field2), "1", "0")</LI-CODE> Sat, 18 Sep 2021 09:59:36 GMT ITWhisperer 2021-09-18T09:59:36Z https://community.splunk.com/t5/Splunk-Search/Eval-Substring-Match/m-p/567494#M197771 <P>Anyone have a good method for doing substring matches where field1 is my searched field and field2 is my substring I want to search for? Attempted to use the following logic without any luck and running low on ideas.</P><P>&nbsp;</P><LI-CODE lang="markup">| eval comparison = if(like(field1, %field2%), "1", "0")</LI-CODE><P>&nbsp;</P><P>field1 is a URL and field2 is a base domain, but field2 is input from a lookup, so it's variable but would look something like:</P><P>&nbsp;</P><LI-CODE lang="markup">field1="http://www.yahoo.com/mail/inbox" field2="yahoo" OR field1="linkedin.com/company/google/profile" field2="google"</LI-CODE><P>&nbsp;</P><P>I'm low on ideas after spending my time in docs and forums all day.</P> Sat, 18 Sep 2021 00:44:01 GMT https://community.splunk.com/t5/Splunk-Search/Eval-Substring-Match/m-p/567494#M197771 wilcomply 2021-09-18T00:44:01Z https://community.splunk.com/t5/Splunk-Search/Eval-Substring-Match/m-p/567508#M197780 <P>Use match not like</P><LI-CODE lang="markup">| makeresults | eval field1="http://www.yahoo.com/mail/inbox" | eval field2="yahoo" | eval field3="linkedin.com/company/google/profile" | eval field4="google" | eval comparison1 = if(match(field1, field2), "1", "0") | eval comparison2 = if(match(field3, field4), "1", "0") | eval comparison3 = if(match(field1, field4), "1", "0") | eval comparison4 = if(match(field3, field2), "1", "0")</LI-CODE> Sat, 18 Sep 2021 09:59:36 GMT https://community.splunk.com/t5/Splunk-Search/Eval-Substring-Match/m-p/567508#M197780 ITWhisperer 2021-09-18T09:59:36Z https://community.splunk.com/t5/Splunk-Search/Eval-Substring-Match/m-p/567528#M197787 <P>You might also concatenate values with wildcards (could be useful in case of more complicated patterns)</P><PRE>| eval result=if(like(field1, "%".field2."%"),1,0)</PRE> Sat, 18 Sep 2021 19:46:31 GMT https://community.splunk.com/t5/Splunk-Search/Eval-Substring-Match/m-p/567528#M197787 PickleRick 2021-09-18T19:46:31Z