Splunk Search

How to match a partial string in search

New Member

Hi,
I have a field called CommonName, sample value of CommonName are below:

  1. CommonName = xyz.apac.ent.bhpbilliton.net
  2. CommonName = xyz.ent.bhpbilliton.net
  3. CommonName = xyz.emea.ent.bhpbilliton.net
  4. CommonName = xyz.abc.ent.bhpbilliton.net

I want to match 2nd value ONLY I am using- CommonName like "%.ent.bhpbilliton.net", it gives all above-listed CommonName.
I want to select only 2nd one, Please advice here.

Thanks in advance.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

The % character in the match function matches everything. Since your four sample values all end with the string in your match they all match. To have a more specific matching pattern, you'll need to use a regular expression in the like function like this:

... | where like(CommonName, "^[^\.]+\.*\.ent\.bhpbilliton\.net") | ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Influencer

You can use your query like this..

<your index search>| rex field=CommonName "\w+.(?<str>\w+.\w+.\w+)"| where str="ent.bhpbilliton.net"

SplunkTrust
SplunkTrust

The % character in the match function matches everything. Since your four sample values all end with the string in your match they all match. To have a more specific matching pattern, you'll need to use a regular expression in the like function like this:

... | where like(CommonName, "^[^\.]+\.*\.ent\.bhpbilliton\.net") | ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

New Member

Thank you so much , it worked 🙂

0 Karma

New Member

Hi ,
I am trying to use like this -
| eval access=if(((occurrences>1 OR RequestEMail like "dl-%@%.com" ) AND (RequestCommonName like "^[^.]+.*.ent.bhpbilliton.net") ) , "Grant" , "Reject")

But here it goes to access= "Reject" , how I can use this in eval .

Thank you

0 Karma