Splunk Search

How to create a search that provides option for a LIKE and not LIKE option

GaryZ
Path Finder

Is there a way of creating a search where we can have both LIKE and NOT LIKE, based on user selected option?

 

ie. 

if $user_option_tk$ == True:

        | where NOT (error_string LIKE "%$filter_tk$%")

else:

        | where error_string LIKE "%$filter_tk$%"

Labels (4)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Use the filter token to classify your data (set a synthetic field to either 1 or 0 (or true/false, green/red or whatever you want) and then do a "where" command depending on the option token - match eithee the 0s or 1s of your synthetic field.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Synthetic Monitoring - Resolved Incident on Detector Alerts

We’ve discovered a bug that affected the auto-clear of Synthetic Detectors in the Splunk Synthetic Monitoring ...

Video | Tom’s Smartness Journey Continues

Remember Splunk Community member Tom Kopchak? If you caught the first episode of our Smartness interview ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud? Learn how unique features like ...