Splunk Search

How to match a partial string in search

himanshu_b_shek
New Member

Hi,
I have a field called CommonName, sample value of CommonName are below:

  1. CommonName = xyz.apac.ent.bhpbilliton.net
  2. CommonName = xyz.ent.bhpbilliton.net
  3. CommonName = xyz.emea.ent.bhpbilliton.net
  4. CommonName = xyz.abc.ent.bhpbilliton.net

I want to match 2nd value ONLY I am using- CommonName like "%.ent.bhpbilliton.net", it gives all above-listed CommonName.
I want to select only 2nd one, Please advice here.

Thanks in advance.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The % character in the match function matches everything. Since your four sample values all end with the string in your match they all match. To have a more specific matching pattern, you'll need to use a regular expression in the like function like this:

... | where like(CommonName, "^[^\.]+\.*\.ent\.bhpbilliton\.net") | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

Vijeta
Influencer

You can use your query like this..

<your index search>| rex field=CommonName "\w+.(?<str>\w+.\w+.\w+)"| where str="ent.bhpbilliton.net"

richgalloway
SplunkTrust
SplunkTrust

The % character in the match function matches everything. Since your four sample values all end with the string in your match they all match. To have a more specific matching pattern, you'll need to use a regular expression in the like function like this:

... | where like(CommonName, "^[^\.]+\.*\.ent\.bhpbilliton\.net") | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

himanshu_b_shek
New Member

Thank you so much , it worked 🙂

0 Karma

himanshu_b_shek
New Member

Hi ,
I am trying to use like this -
| eval access=if(((occurrences>1 OR Request_EMail like "dl-%@%.com" ) AND (Request_CommonName like "^[^.]+.*.ent.bhpbilliton.net") ) , "Grant" , "Reject")

But here it goes to access= "Reject" , how I can use this in eval .

Thank you

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...