Splunk Search

How to match portion of string between two fields in splunk

obais9346
Engager

Example:

field1=ADOBE INC.

field2=ADOBE SYSTEMS&sep1; INCORPORATED

i want to match this as both fields containing "ADOBE" in string, i am a advanced beginner to splunk 

i have tried below condition in my splunk search but no luck(did not work)

..........| eval results= if(like(field1,"%".field2."%"),"Yes","No")

Please help and it is appreciated.

Thank You:)

Labels (1)
0 Karma

obais9346
Engager

Thanks for making me understand

But my requirement is to match 

field1=ADOBE INC.

field2=ADOBE SYSTEMS&sep1; INCORPORATED

How do i achieve this?

thanks in advance!

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Are you expecting these to fields to appear equal in some way? If so, what criterion do you want to use to say that they are equal? 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You won't get a match because field2 does not exist in field1, but also field1 doesn't exist in field2, but if field1 was just "ADOBE" it would match

| makeresults
| eval field1="ADOBE"
| eval field2="ADOBE SYSTEMS INCORPORATED"
| eval result=if(like(field2,"%".field1."%"),"Yes","No")
0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...