Splunk Search

Find values contained on another filed not exact match

Mary666
Communicator

Hello All, 

This may seem easy, but its been quite tedious. How can I create one field that has common values from two separate strings:

Example: 

Field 1=123_yyy  Field 2=777_x_123_0

Desired Results= New Field = 123 

I have tried the below, but it only gives me false --- I know they dont match - I just want what is matching - any suggestions anyone? 

 | eval matched=if(like(Field1,"%".Field2."%"),"True","False")

 

Labels (3)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @Mary666 

If your fields 1,2 having set pattern with _ as delimiter you could try something like this.

| makeresults 
| eval Field1="123_yyy", Field2="777_x_123_0" 
| eval f1=mvindex(split(Field1, "_"),0), f2=mvindex(split(Field2, "_"),2) 
| eval bool=if(f1 == f2, "True", "False")

 --

An upvote would be appreciated if this reply helps! 

View solution in original post

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @Mary666 

If your fields 1,2 having set pattern with _ as delimiter you could try something like this.

| makeresults 
| eval Field1="123_yyy", Field2="777_x_123_0" 
| eval f1=mvindex(split(Field1, "_"),0), f2=mvindex(split(Field2, "_"),2) 
| eval bool=if(f1 == f2, "True", "False")

 --

An upvote would be appreciated if this reply helps! 

0 Karma

Mary666
Communicator

That works for that example, but what if there is no defined pattern and I only want the exact match... lets say:

Blue123_yz_pz

Blue123_yz_pz_flz

Result should be: Blue123_yz_pz

Is there a way of doing this without using REX and if the patterns vary? Thanks in Advance

0 Karma

venkatasri
SplunkTrust
SplunkTrust

should know what's been compared and either extract using rex or other functions like split, substring. Pattern is must generic solution is tough without knowing how the data is structured.

0 Karma

Mary666
Communicator

Thanks for your help, basically using split and mvindex did the trick. Thanks!

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...