Splunk Search

Find values contained on another filed not exact match

Mary666
Communicator

Hello All, 

This may seem easy, but its been quite tedious. How can I create one field that has common values from two separate strings:

Example: 

Field 1=123_yyy  Field 2=777_x_123_0

Desired Results= New Field = 123 

I have tried the below, but it only gives me false --- I know they dont match - I just want what is matching - any suggestions anyone? 

 | eval matched=if(like(Field1,"%".Field2."%"),"True","False")

 

Labels (3)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @Mary666 

If your fields 1,2 having set pattern with _ as delimiter you could try something like this.

| makeresults 
| eval Field1="123_yyy", Field2="777_x_123_0" 
| eval f1=mvindex(split(Field1, "_"),0), f2=mvindex(split(Field2, "_"),2) 
| eval bool=if(f1 == f2, "True", "False")

 --

An upvote would be appreciated if this reply helps! 

View solution in original post

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @Mary666 

If your fields 1,2 having set pattern with _ as delimiter you could try something like this.

| makeresults 
| eval Field1="123_yyy", Field2="777_x_123_0" 
| eval f1=mvindex(split(Field1, "_"),0), f2=mvindex(split(Field2, "_"),2) 
| eval bool=if(f1 == f2, "True", "False")

 --

An upvote would be appreciated if this reply helps! 

0 Karma

Mary666
Communicator

That works for that example, but what if there is no defined pattern and I only want the exact match... lets say:

Blue123_yz_pz

Blue123_yz_pz_flz

Result should be: Blue123_yz_pz

Is there a way of doing this without using REX and if the patterns vary? Thanks in Advance

0 Karma

venkatasri
SplunkTrust
SplunkTrust

should know what's been compared and either extract using rex or other functions like split, substring. Pattern is must generic solution is tough without knowing how the data is structured.

0 Karma

Mary666
Communicator

Thanks for your help, basically using split and mvindex did the trick. Thanks!

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...