Splunk Search

Conditionaly Change form input variable value in the form search query

hartfoml
Motivator

I have a form that is doing SQL seach and Splunk Search using one veriable input text. When I want to use a wild card in the form I put in a "%" for SQL but this does not work for Splunk. For splunk I need to use a "*".

I tried using the eval with the if commend to change the wild card but this did not work

useing:
<input type="text" token="ip">


Then puting in the wild card "%" in the form

Then | dbquery MVM "SELECT * from TABLE WHERE IP LIKE '%$ip$%'

the SQL search runes like this | dbquery MVM "SELECT * from TABLE WHERE IP LIKE '%%%'

Then index=foo | eval ip=if(ip="%","*",ip) | search IP="*$ip$*"

the splunk search runes like this index=foo | eval ip=if(ip="%","*",ip) | search IP="*%*"

How can I convert the % to a * for the splunk search?

0 Karma

sundareshr
Legend

For your splunk search, have you tried .. | where like(ip, $ip$). With this approach, you will not have to change the % to *. Give it a try!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...