topic Re: Is there a way to check if a field value is present in a transaction? in Splunk Search

Is there a way to check if a field value is present in a transaction?

jluo_splunk — Thu, 21 Jan 2016 22:36:49 GMT

The transaction command has the options startswith and endswith, but is there a "contains" of some sort that can be used, just to say that somewhere in the transaction there should be some field value?

Re: Is there a way to check if a field value is present in a transaction?

javiergn — Thu, 21 Jan 2016 22:45:00 GMT

Is this what you are talking about?

startswith=eval(match(yourfield,"yourvalue"))
endswith=eval(match(yourfield,"yourvalue"))

You can use regex too or even conditionals inside your eval.
See transaction reference help page.

Re: Is there a way to check if a field value is present in a transaction?

MattZerfas — Thu, 21 Jan 2016 22:45:45 GMT

I have used a regex in a match statement before like below and it seems to work fine. Maybe try that?

startswith=eval(match(eventName,".*SkipFwd"))

Re: Is there a way to check if a field value is present in a transaction?

jluo_splunk — Thu, 21 Jan 2016 22:50:41 GMT

My issue is I don't necessarily want it to start with this field value. I just want to check that the field value is somewhere in there, not necessarily the beginning or the end.

Re: Is there a way to check if a field value is present in a transaction?

jluo_splunk — Thu, 21 Jan 2016 22:50:49 GMT

My issue is I don't necessarily want it to start with this field value. I just want to check that the field value is somewhere in there, not necessarily the beginning or the end.

Re: Is there a way to check if a field value is present in a transaction?

MattZerfas — Fri, 22 Jan 2016 03:02:13 GMT

O then you could just do a |search foo=bar or |where foo=bar after your transaction depending on what you are wanting to look for.

Re: Is there a way to check if a field value is present in a transaction?

jluo_splunk — Fri, 22 Jan 2016 18:18:21 GMT

That did it - thank you MattZerfas!