Reporting

How to match a condition based on a regex in string

cindygibbs_08
Communicator

Hello Lovely people

 

I have a field that contains values contatenated by the "." character and the values of this fields may be something like this:

uhss.didhikd.8979.ODJD.73HJ.Uber.39383.7854
dhikd.8979.ODUber.JD.73HJ.39383.7854
undñ_opl.Uber.iolddld
ddidjd_iddd_lioft_yes

What I want is to detect is if the string has the characters ".Uber" that means a "." next to "Uber" if that is true I want the variableRIDE to be 1 if not I want that variable to be 0, I would really enjoy your help guys thank you so much.. so for the last example:

FIELDRIDE
uhss.didhikd.8979.ODJD.73HJ.Uber.39383.78541
dhikd.8979.ODUber.JD.73HJ.39383.78541
undñ_opl.Uber.iolddld1
ddidjd_iddd_lioft_yes0

 

Thank you so much guys!

Labels (1)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @cindygibbs_08 

Can you try this? I assumed your field_name as FIELD feel free to change

<your_search_goes_here> 
| eval RIDE=if(like(FIELD,"%.Uber%"), 1,0) 
| table FIELD RIDE

 

---

An upvote would be appreciated and Accept Solution if it helps!

View solution in original post

venkatasri
SplunkTrust
SplunkTrust

Hi @cindygibbs_08 

Can you try this? I assumed your field_name as FIELD feel free to change

<your_search_goes_here> 
| eval RIDE=if(like(FIELD,"%.Uber%"), 1,0) 
| table FIELD RIDE

 

---

An upvote would be appreciated and Accept Solution if it helps!

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...