Splunk Search

How to distinguish two similar strings


Hello I have two similar strings that I need to differentiate.  These are the key words in the String 

1. Special 

2 Specialist 

When they come into Splunk it comes in as a command:


"Alter User Special"

"Alter User Specialist" 

Currently I am using these queries:


host=*| eval SPECIALIST=if(like(EVNTCOMMAND, "% SPECIALIST%"),1,0)| chart sum(SPECIALIST)



host=*| eval SPECIAL=if(like(EVNTCOMMAND, "% SPECIAL%"),1,0)| chart sum(SPECIAL)


I need the  % after Special and Specialist because sometimes there is more data after those strings.

Any Suggestions?

Thank you,


Labels (3)
0 Karma


Use match and a regex for special/specialist followed by space or end of line

| makeresults 
| eval _raw="Alter User Special abc
Alter User Specialist
Alter User Specialists
Alter User Special
Alter User Specials
Alter User Specialist xyz"
| multikv noheader=t
| fields _raw
| eval special=if(match(_raw," Special(\s|$)"),true(),null)
| eval specialist=if(match(_raw," Specialist(\s|$)"),true(),null)


Thank you,

using the REGEX example i was able to generate a count but since I am not to familiar with REGEX I did it another way.

host=*| eval SPECIAL=if(like(COMMAND, "% SPECIAL") OR like(COMMAND, "% SPECIAL %"),1,0)| chart sum(SPECIAL)

Using an Or statement gets me the same results. 


0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...