https://community.splunk.com/t5/Splunk-Search/how-to-match-partial-string-in-search-query/m-p/293731#M88666 <P>Hi</P> <P>I have a errors in the field (say myfield)</P> <P>Error xyz : 123<BR /> Error xyz : 456<BR /> Error xyz : 789<BR /> Error xyz : 135<BR /> Error xyz : 987 </P> <P>i want to group it by matching the partial values of a string like<BR /> | eval myfield=if(myfield=="Error xyz*","Error xyz",myfield)</P> <P>So myfields should contain values </P> <P>"Error xyz" and other errors<BR /> (i am tring to group myfield values which starts with "Error xyz" )<BR /> how can i do this</P> Mon, 15 May 2017 15:31:57 GMT sravankaripe 2017-05-15T15:31:57Z https://community.splunk.com/t5/Splunk-Search/how-to-match-partial-string-in-search-query/m-p/293731#M88666 <P>Hi</P> <P>I have a errors in the field (say myfield)</P> <P>Error xyz : 123<BR /> Error xyz : 456<BR /> Error xyz : 789<BR /> Error xyz : 135<BR /> Error xyz : 987 </P> <P>i want to group it by matching the partial values of a string like<BR /> | eval myfield=if(myfield=="Error xyz*","Error xyz",myfield)</P> <P>So myfields should contain values </P> <P>"Error xyz" and other errors<BR /> (i am tring to group myfield values which starts with "Error xyz" )<BR /> how can i do this</P> Mon, 15 May 2017 15:31:57 GMT https://community.splunk.com/t5/Splunk-Search/how-to-match-partial-string-in-search-query/m-p/293731#M88666 sravankaripe 2017-05-15T15:31:57Z https://community.splunk.com/t5/Splunk-Search/how-to-match-partial-string-in-search-query/m-p/293732#M88667 <P>try this</P> <P>| eval temp= mvfilter(match(myfield,"Error xyz")) | eval myfield=if(myfield==temp,"Error xyz",myfield)</P> <P>if it won't work, please provide me more info</P> Mon, 15 May 2017 15:37:25 GMT https://community.splunk.com/t5/Splunk-Search/how-to-match-partial-string-in-search-query/m-p/293732#M88667 SplunkersRock 2017-05-15T15:37:25Z