Splunk Search

Eval Substring Match?

wilcomply
Observer

Anyone have a good method for doing substring matches where field1 is my searched field and field2 is my substring I want to search for? Attempted to use the following logic without any luck and running low on ideas.

 

| eval comparison = if(like(field1, %field2%), "1", "0")

 

field1 is a URL and field2 is a base domain, but field2 is input from a lookup, so it's variable but would look something like:

 

field1="http://www.yahoo.com/mail/inbox"
field2="yahoo"

OR

field1="linkedin.com/company/google/profile"
field2="google"

 

I'm low on ideas after spending my time in docs and forums all day.

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use match not like

| makeresults
| eval field1="http://www.yahoo.com/mail/inbox"
| eval field2="yahoo"
| eval field3="linkedin.com/company/google/profile"
| eval field4="google"
| eval comparison1 = if(match(field1, field2), "1", "0")
| eval comparison2 = if(match(field3, field4), "1", "0")
| eval comparison3 = if(match(field1, field4), "1", "0")
| eval comparison4 = if(match(field3, field2), "1", "0")
0 Karma

PickleRick
SplunkTrust
SplunkTrust

You might also concatenate values with wildcards (could be useful in case of more complicated patterns)

| eval result=if(like(field1, "%".field2."%"),1,0)
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...