Splunk Search

How to distinguish two similar strings


Hello I have two similar strings that I need to differentiate.  These are the key words in the String 

1. Special 

2 Specialist 

When they come into Splunk it comes in as a command:


"Alter User Special"

"Alter User Specialist" 

Currently I am using these queries:


host=*| eval SPECIALIST=if(like(EVNTCOMMAND, "% SPECIALIST%"),1,0)| chart sum(SPECIALIST)



host=*| eval SPECIAL=if(like(EVNTCOMMAND, "% SPECIAL%"),1,0)| chart sum(SPECIAL)


I need the  % after Special and Specialist because sometimes there is more data after those strings.

Any Suggestions?

Thank you,


Labels (3)
0 Karma

Ultra Champion

Use match and a regex for special/specialist followed by space or end of line

| makeresults 
| eval _raw="Alter User Special abc
Alter User Specialist
Alter User Specialists
Alter User Special
Alter User Specials
Alter User Specialist xyz"
| multikv noheader=t
| fields _raw
| eval special=if(match(_raw," Special(\s|$)"),true(),null)
| eval specialist=if(match(_raw," Specialist(\s|$)"),true(),null)


Thank you,

using the REGEX example i was able to generate a count but since I am not to familiar with REGEX I did it another way.

host=*| eval SPECIAL=if(like(COMMAND, "% SPECIAL") OR like(COMMAND, "% SPECIAL %"),1,0)| chart sum(SPECIAL)

Using an Or statement gets me the same results. 


0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!