Splunk Search

Find values contained on another filed not exact match

Mary666
Communicator

Hello All, 

This may seem easy, but its been quite tedious. How can I create one field that has common values from two separate strings:

Example: 

Field 1=123_yyy  Field 2=777_x_123_0

Desired Results= New Field = 123 

I have tried the below, but it only gives me false --- I know they dont match - I just want what is matching - any suggestions anyone? 

 | eval matched=if(like(Field1,"%".Field2."%"),"True","False")

 

Labels (3)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @Mary666 

If your fields 1,2 having set pattern with _ as delimiter you could try something like this.

| makeresults 
| eval Field1="123_yyy", Field2="777_x_123_0" 
| eval f1=mvindex(split(Field1, "_"),0), f2=mvindex(split(Field2, "_"),2) 
| eval bool=if(f1 == f2, "True", "False")

 --

An upvote would be appreciated if this reply helps! 

View solution in original post

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @Mary666 

If your fields 1,2 having set pattern with _ as delimiter you could try something like this.

| makeresults 
| eval Field1="123_yyy", Field2="777_x_123_0" 
| eval f1=mvindex(split(Field1, "_"),0), f2=mvindex(split(Field2, "_"),2) 
| eval bool=if(f1 == f2, "True", "False")

 --

An upvote would be appreciated if this reply helps! 

0 Karma

Mary666
Communicator

That works for that example, but what if there is no defined pattern and I only want the exact match... lets say:

Blue123_yz_pz

Blue123_yz_pz_flz

Result should be: Blue123_yz_pz

Is there a way of doing this without using REX and if the patterns vary? Thanks in Advance

0 Karma

venkatasri
SplunkTrust
SplunkTrust

should know what's been compared and either extract using rex or other functions like split, substring. Pattern is must generic solution is tough without knowing how the data is structured.

0 Karma

Mary666
Communicator

Thanks for your help, basically using split and mvindex did the trick. Thanks!

0 Karma
Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...