how can i make a case condition to check if StingA is in StringB?
for example StingA is "xxx.com." StingB is: "a.xxx.com."
Try this:
... | eval match=if(like(fieldB,fieldA),1,0) | search match=1
if the list of domains are not in a field but in a lookup table, how does that change the query?
for example:
i have a list of domain in a lookup table
and i have a list of domain in a field
and i want to check if the list of domains in the field are in the lookup table
In that case...
... | rename domain as domainFromIndex
| inputlookup lookupName domain as domain OUTPUTNEW domainFromLookup
| eval match=if(domainFromIndex=domainFromLookup,1,0)
| where match=1