Find a field value string that is partially present in another field value string.

[lbogle]

Hi Splunkers,
I'm trying to work through a search where I have a base query delivering usernames and some corresponding hostnames. Hostnames are usually in the form of pc-username. There are frequently variants where the user will have pc-username-2 or pc-username-W7 etc. but typically 'username' is in there somewhere.
What would be a way for me to locate instances where hostname contained the actual username and identify that instance as "True". OR instances where the hostname didn't contain the actual username and identify that instance as "False"?
IE the first two results would be marked as true and the last one would be marked as false in the results below.

index=foo sourcetype=bar | table username,hostname

RequestorName MachineName
gtron pc-gtron
karthur pc-karthur-w8
tkhan pc-support-test

Thanks for your help!

[lguinn2 · Accepted solution]

Try this

index=foo sourcetype=bar
| eval matched=if(like(hostname,"%".username."%"),"True","False")
| table username hostname matched

[lbogle]

Seriously, every time you pick up one of my questions, I get super excited because I know you almost always take the time to answer and answer correctly! Minus the extra parenthesis, that did it!
You rock!
Thanks!

[lguinn2]

Thanks, guys - and I fixed the typo...

[ppablo]

This makes me happy ;D Also, @lguinn is a rockstar!

[piebob]

+1, upgoats for @lguinn!