Splunk Search

Eval Substring Match?

wilcomply
Observer

Anyone have a good method for doing substring matches where field1 is my searched field and field2 is my substring I want to search for? Attempted to use the following logic without any luck and running low on ideas.

 

| eval comparison = if(like(field1, %field2%), "1", "0")

 

field1 is a URL and field2 is a base domain, but field2 is input from a lookup, so it's variable but would look something like:

 

field1="http://www.yahoo.com/mail/inbox"
field2="yahoo"

OR

field1="linkedin.com/company/google/profile"
field2="google"

 

I'm low on ideas after spending my time in docs and forums all day.

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use match not like

| makeresults
| eval field1="http://www.yahoo.com/mail/inbox"
| eval field2="yahoo"
| eval field3="linkedin.com/company/google/profile"
| eval field4="google"
| eval comparison1 = if(match(field1, field2), "1", "0")
| eval comparison2 = if(match(field3, field4), "1", "0")
| eval comparison3 = if(match(field1, field4), "1", "0")
| eval comparison4 = if(match(field3, field2), "1", "0")
0 Karma

PickleRick
SplunkTrust
SplunkTrust

You might also concatenate values with wildcards (could be useful in case of more complicated patterns)

| eval result=if(like(field1, "%".field2."%"),1,0)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

Data Management Digest – May 2026

Welcome to the May 2026 edition of Data Management Digest!   As your trusted partner in data innovation, the ...