How to match a partial string in search

[himanshu_b_shek]

Hi,
I have a field called CommonName, sample value of CommonName are below:

1. CommonName = xyz.apac.ent.bhpbilliton.net
2. CommonName = xyz.ent.bhpbilliton.net
3. CommonName = xyz.emea.ent.bhpbilliton.net
4. CommonName = xyz.abc.ent.bhpbilliton.net

I want to match 2nd value ONLY I am using- CommonName like "%.ent.bhpbilliton.net", it gives all above-listed CommonName.
I want to select only 2nd one, Please advice here.

Thanks in advance.

[Vijeta]

You can use your query like this..

<your index search>| rex field=CommonName "\w+.(?<str>\w+.\w+.\w+)"| where str="ent.bhpbilliton.net"

[richgalloway · Accepted solution]

The % character in the match function matches everything. Since your four sample values all end with the string in your match they all match. To have a more specific matching pattern, you'll need to use a regular expression in the like function like this:

... | where like(CommonName, "^[^\.]+\.*\.ent\.bhpbilliton\.net") | ...

[himanshu_b_shek]

Thank you so much , it worked 🙂

[himanshu_b_shek]

Hi ,
I am trying to use like this -
| eval access=if(((occurrences>1 OR Request_EMail like "dl-%@%.com" ) AND (Request_CommonName like "^[^.]+.*.ent.bhpbilliton.net") ) , "Grant" , "Reject")

But here it goes to access= "Reject" , how I can use this in eval .

Thank you