Reporting

How to match a condition based on a regex in string

cindygibbs_08
Communicator

Hello Lovely people

 

I have a field that contains values contatenated by the "." character and the values of this fields may be something like this:

uhss.didhikd.8979.ODJD.73HJ.Uber.39383.7854
dhikd.8979.ODUber.JD.73HJ.39383.7854
undñ_opl.Uber.iolddld
ddidjd_iddd_lioft_yes

What I want is to detect is if the string has the characters ".Uber" that means a "." next to "Uber" if that is true I want the variableRIDE to be 1 if not I want that variable to be 0, I would really enjoy your help guys thank you so much.. so for the last example:

FIELDRIDE
uhss.didhikd.8979.ODJD.73HJ.Uber.39383.78541
dhikd.8979.ODUber.JD.73HJ.39383.78541
undñ_opl.Uber.iolddld1
ddidjd_iddd_lioft_yes0

 

Thank you so much guys!

Labels (1)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @cindygibbs_08 

Can you try this? I assumed your field_name as FIELD feel free to change

<your_search_goes_here> 
| eval RIDE=if(like(FIELD,"%.Uber%"), 1,0) 
| table FIELD RIDE

 

---

An upvote would be appreciated and Accept Solution if it helps!

View solution in original post

venkatasri
SplunkTrust
SplunkTrust

Hi @cindygibbs_08 

Can you try this? I assumed your field_name as FIELD feel free to change

<your_search_goes_here> 
| eval RIDE=if(like(FIELD,"%.Uber%"), 1,0) 
| table FIELD RIDE

 

---

An upvote would be appreciated and Accept Solution if it helps!

Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...