Conditionaly Change form input variable value in the form search query

hartfoml — Wed, 09 Dec 2015 20:36:17 GMT

I have a form that is doing SQL seach and Splunk Search using one veriable input text. When I want to use a wild card in the form I put in a "%" for SQL but this does not work for Splunk. For splunk I need to use a "*".

I tried using the eval with the if commend to change the wild card but this did not work

useing:
<input type="text" token="ip">
IP Address

Then puting in the wild card "%" in the form

Then | dbquery MVM "SELECT * from TABLE WHERE IP LIKE '%$ip$%'

the SQL search runes like this | dbquery MVM "SELECT * from TABLE WHERE IP LIKE '%%%'

Then index=foo | eval ip=if(ip="%","*",ip) | search IP="*$ip$*"

the splunk search runes like this index=foo | eval ip=if(ip="%","*",ip) | search IP="*%*"

How can I convert the % to a * for the splunk search?

Re: Conditionaly Change form input variable value in the form search query

sundareshr — Thu, 10 Dec 2015 01:06:22 GMT

For your splunk search, have you tried .. | where like(ip, $ip$). With this approach, you will not have to change the % to *. Give it a try!

topic Re: Conditionaly Change form input variable value in the form search query in Splunk Search

Conditionaly Change form input variable value in the form search query

Re: Conditionaly Change form input variable value in the form search query