topic Re: How to write a search with the condition "if field1 NOT LIKE field2"? in Splunk Search

How to write a search with the condition "if field1 NOT LIKE field2"?

karthikmalla — Wed, 30 Nov 2016 01:17:01 GMT

Hello,

I am aware of the following search syntax

field1 = *something*
field1 = field2
field1 != field2

But I wish to write something like:

field1 != *field2* but this is typically meant to search if field2 doesn't contain field1, but instead it's just searching field2 as text as it's set within asterisks.

Can anyone provide me the syntax to search with this criteria? Thanks

Re: How to write a search with the condition "if field1 NOT LIKE field2"?

gokadroid — Wed, 30 Nov 2016 01:41:38 GMT

Can you check the match function here which might be what u r looking for:
https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/CommonEvalFunctions

OR few possible combinations for matching two fields are here
https://answers.splunk.com/answers/315143/how-to-search-a-field-for-text-from-another-field.html

Updating answer as per the comments

your base search | where NOT LIKE(Field1,"%".Field2."%")

Your base search | where NOT match(Field1,".*".Field2.".*")

 your base search | search Field1!=".*".Field2.".*"

Re: How to write a search with the condition "if field1 NOT LIKE field2"?

jkat54 — Wed, 30 Nov 2016 03:05:13 GMT

After much hair pulling with the trust (to be read as the last hour of my life), I've decided I'm going to share a custom spl command and instructions on how to use it. In the morning though, not tonight.

Re: How to write a search with the condition "if field1 NOT LIKE field2"?

puneethgowda — Wed, 30 Nov 2016 04:00:39 GMT

index=A | where like(Field, "%something%")

Re: How to write a search with the condition "if field1 NOT LIKE field2"?

puneethgowda — Wed, 30 Nov 2016 04:03:05 GMT

index=A | where NOT like(field1, "%H%")

Re: How to write a search with the condition "if field1 NOT LIKE field2"?

karthikmalla — Wed, 30 Nov 2016 04:10:24 GMT

@puneethgowda - I am not sure if you understood my question. I believe %something% and %H% will search something that's a static text, I need to search within a dynamic field. Can you please read my question once again? thanks

Re: How to write a search with the condition "if field1 NOT LIKE field2"?

gokadroid — Wed, 30 Nov 2016 04:51:04 GMT

Did u check the @somesoni2's answer in the second link i Posted. It has exactly what u need. Let me repaste his answer there, here too:

your base search | where NOT LIKE(Field_A,"%".Field_B."%") 

 OR 

 Your base search | where NOT match(Field_A,".*".Field_B.".*") 

 OR 

 your base search | search Field_A!=".*".Field_B.".*"

Re: How to write a search with the condition "if field1 NOT LIKE field2"?

jkat54 — Wed, 30 Nov 2016 09:40:09 GMT

Only this won't work if field2 has _ or %.

Re: How to write a search with the condition "if field1 NOT LIKE field2"?

yepyepyayyooo — Mon, 30 Dec 2019 14:41:10 GMT

No one answered karthikmalla question. He wanted to to return or filter results where field1 is present NOT present within field2. An example of why this is necessary is when field 2 is an array. For example:

Field1=1.1.1.1
Field2= 1.1.1.1, 1.1.1.2, 1.1.1.3, 1.1.1.4

So he needs to be able to search within Field2 and see if any of the values match the Field1 value or values.