How to add "LIKE" instead of "=" and add wildcard to search?

amandaxtru — Tue, 29 Sep 2020 10:12:15 GMT

 <title>Routers</title>

Outputs: ( ( ROUTER="PHIL" ) OR ( ROUTER="PHL02" ) OR ( ROUTER="PHL23" ) OR ( ROUTER="PHL24" ) OR ( ROUTER="PHL6" ) OR ( ROUTER="PHL8" ) OR ( ROUTER="PHLAPA" ) )

How would I make it so it would be like (ROUTER LIKE "PHIL%") with the "%" wildcard? I'm trying to use these router prefixes to find all routers with that prefix. Thanks in advance!

Re: How to add "LIKE" instead of "=" and add wildcard to search?

sundareshr — Wed, 13 Jul 2016 19:47:43 GMT

Like this

| dbquery "routerdb" "SELECT DEVICE_LOC FROM routerdb.LKP_LOCATION_EDITED WHERE METRO_CITY LIKE '%Philadelphia%'" 
| stats count by DEVICE_LOC
| fields - count 
| eval ROUTER=DEVICE_LOC."%"
| fields ROUTER
| format
| eval search=replace(search, "=", " LIKE ")

topic Re: How to add "LIKE" instead of "=" and add wildcard to search? in Splunk Search

How to add "LIKE" instead of "=" and add wildcard to search?

Re: How to add "LIKE" instead of "=" and add wildcard to search?