https://community.splunk.com/t5/Splunk-Search/subsearch-query/m-p/159894#M45153 <P>Try adding following to end of your search </P> <PRE><CODE>Your current search | eval HasLastNameInEmail=if(like(user_name,"%".p_last."%"),"Yes","No") </CODE></PRE> Tue, 16 Dec 2014 16:14:58 GMT somesoni2 2014-12-16T16:14:58Z https://community.splunk.com/t5/Splunk-Search/subsearch-query/m-p/159893#M45152 <P>I have the following query that works fine.</P> <PRE><CODE>index=pdv OrgId=* | rex field=request_id "SearchString=(?[^\d].*?)\|.*$" | search PatientName=* | rex field=PatientName "(?.*?)[ ,](?.*)" | rex field=client_id "UserId=(?\d+)" | lookup company_administration-user user_id OUTPUT user_name first_name AS u_first last_name AS u_last | table _time OrgId user_name u_first u_last p_first p_last </CODE></PRE> <P>I want to add a subsearch that looks for all occurrences where p_last is within user_name. I don't know how to adjust the query to get this result - can anyone help please? In other words - user_name is an email address and p_last is a users last name. I want to know when a users last name is within the email address.</P> <P>thank you.</P> Mon, 28 Sep 2020 18:27:40 GMT https://community.splunk.com/t5/Splunk-Search/subsearch-query/m-p/159893#M45152 brenisro 2020-09-28T18:27:40Z https://community.splunk.com/t5/Splunk-Search/subsearch-query/m-p/159894#M45153 <P>Try adding following to end of your search </P> <PRE><CODE>Your current search | eval HasLastNameInEmail=if(like(user_name,"%".p_last."%"),"Yes","No") </CODE></PRE> Tue, 16 Dec 2014 16:14:58 GMT https://community.splunk.com/t5/Splunk-Search/subsearch-query/m-p/159894#M45153 somesoni2 2014-12-16T16:14:58Z https://community.splunk.com/t5/Splunk-Search/subsearch-query/m-p/159895#M45154 <P>Thank you very much - that works perfectly!!</P> Tue, 16 Dec 2014 16:31:27 GMT https://community.splunk.com/t5/Splunk-Search/subsearch-query/m-p/159895#M45154 brenisro 2014-12-16T16:31:27Z