topic How to create a search that provides option for a LIKE and not LIKE option in Splunk Search

How to create a search that provides option for a LIKE and not LIKE option

GaryZ — Mon, 11 Dec 2023 22:18:35 GMT

Is there a way of creating a search where we can have both LIKE and NOT LIKE, based on user selected option?

ie.

if $user_option_tk$ == True:

| where NOT (error_string LIKE "%$filter_tk$%")

else:

| where error_string LIKE "%$filter_tk$%"

Re: How to create a search that provides option for a LIKE and not LIKE option

PickleRick — Mon, 11 Dec 2023 22:31:12 GMT

Use the filter token to classify your data (set a synthetic field to either 1 or 0 (or true/false, green/red or whatever you want) and then do a "where" command depending on the option token - match eithee the 0s or 1s of your synthetic field.