Reporting

How to match a condition based on a regex in string

cindygibbs_08
Communicator

Hello Lovely people

 

I have a field that contains values contatenated by the "." character and the values of this fields may be something like this:

uhss.didhikd.8979.ODJD.73HJ.Uber.39383.7854
dhikd.8979.ODUber.JD.73HJ.39383.7854
undñ_opl.Uber.iolddld
ddidjd_iddd_lioft_yes

What I want is to detect is if the string has the characters ".Uber" that means a "." next to "Uber" if that is true I want the variableRIDE to be 1 if not I want that variable to be 0, I would really enjoy your help guys thank you so much.. so for the last example:

FIELDRIDE
uhss.didhikd.8979.ODJD.73HJ.Uber.39383.78541
dhikd.8979.ODUber.JD.73HJ.39383.78541
undñ_opl.Uber.iolddld1
ddidjd_iddd_lioft_yes0

 

Thank you so much guys!

Labels (1)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @cindygibbs_08 

Can you try this? I assumed your field_name as FIELD feel free to change

<your_search_goes_here> 
| eval RIDE=if(like(FIELD,"%.Uber%"), 1,0) 
| table FIELD RIDE

 

---

An upvote would be appreciated and Accept Solution if it helps!

View solution in original post

venkatasri
SplunkTrust
SplunkTrust

Hi @cindygibbs_08 

Can you try this? I assumed your field_name as FIELD feel free to change

<your_search_goes_here> 
| eval RIDE=if(like(FIELD,"%.Uber%"), 1,0) 
| table FIELD RIDE

 

---

An upvote would be appreciated and Accept Solution if it helps!

Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...