Hi Splunkers,
I'm trying to work through a search where I have a base query delivering usernames and some corresponding hostnames. Hostnames are usually in the form of pc-username. There are frequently variants where the user will have pc-username-2 or pc-username-W7 etc. but typically 'username' is in there somewhere.
What would be a way for me to locate instances where hostname contained the actual username and identify that instance as "True". OR instances where the hostname didn't contain the actual username and identify that instance as "False"?
IE the first two results would be marked as true and the last one would be marked as false in the results below.
index=foo sourcetype=bar | table username,hostname
RequestorName MachineName
gtron pc-gtron
karthur pc-karthur-w8
tkhan pc-support-test
Thanks for your help!
Try this
index=foo sourcetype=bar
| eval matched=if(like(hostname,"%".username."%"),"True","False")
| table username hostname matched
Try this
index=foo sourcetype=bar
| eval matched=if(like(hostname,"%".username."%"),"True","False")
| table username hostname matched
Seriously, every time you pick up one of my questions, I get super excited because I know you almost always take the time to answer and answer correctly! Minus the extra parenthesis, that did it!
You rock!
Thanks!
Thanks, guys - and I fixed the typo...
This makes me happy ;D Also, @lguinn is a rockstar!
+1, upgoats for @lguinn!