Knowledge Management

Why am I having Issues with use of LIKE in macro validation?

Pat
Path Finder

So I have a macro that has a field variable that I want to use a wildcard and worse the field names tend to have dots.  So a good field would be body.system.diskio.write.bytes and I tried using the following:

LIKE($field$, "body_system_diskio%")

with the idea is if would error if the field did not at least contain body.system.diskio.  I put the underscores in as im not sure it could handle the dots.  This does not work for me.  Anyone know what im doing wrong here?

 

EDITED :  I only had two options for conditionals and ended up getting it to work with match($BodySystemDiskIoBytes$, "body.system.diskio.write.bytes|body.system.diskio.read.bytes")

Labels (1)
Tags (2)
0 Karma
1 Solution

Pat
Path Finder

I got this solved by switching to the match  conditional

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Your macro should have single quotes around $field$ so that if your field name has non standard characters (e.g. dots), then it will work, so like this

LIKE('$field$', "body_system_diskio%")
0 Karma

Pat
Path Finder

I got this solved by switching to the match  conditional

0 Karma

Pat
Path Finder

thanks.  This helped somewhat in that it does not fail but now it never fails.  I tried taking it one step further and tried LIKE('$BodySystemDiskIoBytes$', "'body.system.diskio'%") but no luck.  My failure field im using is "body.system.test.write.bytes"

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...