Splunk Search

Find a field value string that is partially present in another field value string.

lbogle
Contributor

Hi Splunkers,
I'm trying to work through a search where I have a base query delivering usernames and some corresponding hostnames. Hostnames are usually in the form of pc-username. There are frequently variants where the user will have pc-username-2 or pc-username-W7 etc. but typically 'username' is in there somewhere.
What would be a way for me to locate instances where hostname contained the actual username and identify that instance as "True". OR instances where the hostname didn't contain the actual username and identify that instance as "False"?
IE the first two results would be marked as true and the last one would be marked as false in the results below.

index=foo sourcetype=bar | table username,hostname

RequestorName MachineName
gtron pc-gtron
karthur pc-karthur-w8
tkhan pc-support-test

Thanks for your help!

Tags (3)
1 Solution

lguinn2
Legend

Try this

index=foo sourcetype=bar
| eval matched=if(like(hostname,"%".username."%"),"True","False")
| table username hostname matched

View solution in original post

lguinn2
Legend

Try this

index=foo sourcetype=bar
| eval matched=if(like(hostname,"%".username."%"),"True","False")
| table username hostname matched

lbogle
Contributor

Seriously, every time you pick up one of my questions, I get super excited because I know you almost always take the time to answer and answer correctly! Minus the extra parenthesis, that did it!
You rock!
Thanks!

lguinn2
Legend

Thanks, guys - and I fixed the typo...

0 Karma

ppablo
Retired

This makes me happy ;D Also, @lguinn is a rockstar!

piebob
Splunk Employee
Splunk Employee

+1, upgoats for @lguinn!

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...