Splunk Enterprise Security

LIKE and like()

ak1508
Explorer

Just want to clear this up so I am not mistaken. Are the two statements equivalent:

 | where like (foo, "bar")

and

| where foo LIKE "bar"

In my test setup I am getting the same search results, I'm wondering if there is anything different on the backend that Splunk does. From the Job inspector it seems they both run the same Optimized search of the first option. Should this be the preferred syntax?

Thanks

niketn
Legend

@ak1508 as per color coding for SPL post Splunk 6.5, the like in the command | where foo like "bar" is an argument as it highlights as orange, but using | where like(foo,"bar") treats it as function and highlights as pink. Refer to Splunk Documentation for the same: https://docs.splunk.com/Documentation/Splunk/latest/Search/Parsingsearches#Color_codes

You should be using the second one because internally Splunk's Query Optimization converts the same to function like().

Which implies following query in Splunk Search

| makeresults
| eval data="testabc"
| where data like "test%"

Converts to the following optimized query when it executes (you can check Job Inspector for details:

 | makeresults 
 | eval data="testabc" 
 | where like(data,"test%")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

jawaharas
Motivator

As per Splunk Docs, below syntax seems preferred.

 .. | where like (foo, "bar")
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...