Splunk Search

Find a field value string that is partially present in another field value string.

lbogle
Contributor

Hi Splunkers,
I'm trying to work through a search where I have a base query delivering usernames and some corresponding hostnames. Hostnames are usually in the form of pc-username. There are frequently variants where the user will have pc-username-2 or pc-username-W7 etc. but typically 'username' is in there somewhere.
What would be a way for me to locate instances where hostname contained the actual username and identify that instance as "True". OR instances where the hostname didn't contain the actual username and identify that instance as "False"?
IE the first two results would be marked as true and the last one would be marked as false in the results below.

index=foo sourcetype=bar | table username,hostname

RequestorName MachineName
gtron pc-gtron
karthur pc-karthur-w8
tkhan pc-support-test

Thanks for your help!

Tags (3)
1 Solution

lguinn2
Legend

Try this

index=foo sourcetype=bar
| eval matched=if(like(hostname,"%".username."%"),"True","False")
| table username hostname matched

View solution in original post

lguinn2
Legend

Try this

index=foo sourcetype=bar
| eval matched=if(like(hostname,"%".username."%"),"True","False")
| table username hostname matched

lbogle
Contributor

Seriously, every time you pick up one of my questions, I get super excited because I know you almost always take the time to answer and answer correctly! Minus the extra parenthesis, that did it!
You rock!
Thanks!

lguinn2
Legend

Thanks, guys - and I fixed the typo...

0 Karma

ppablo
Retired

This makes me happy ;D Also, @lguinn is a rockstar!

piebob
Splunk Employee
Splunk Employee

+1, upgoats for @lguinn!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...