Splunk Search

How to create a search that provides option for a LIKE and not LIKE option

GaryZ
Path Finder

Is there a way of creating a search where we can have both LIKE and NOT LIKE, based on user selected option?

 

ie. 

if $user_option_tk$ == True:

        | where NOT (error_string LIKE "%$filter_tk$%")

else:

        | where error_string LIKE "%$filter_tk$%"

Labels (4)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Use the filter token to classify your data (set a synthetic field to either 1 or 0 (or true/false, green/red or whatever you want) and then do a "where" command depending on the option token - match eithee the 0s or 1s of your synthetic field.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...