Splunk Search

How to write a search to determine if the value of one field is found in the value of another field?

olheiser01
New Member

I am trying to return a result when one field contains another. For example,

field1="ABCDEFG"
field2="CDE"

Match= True

I wanted to try something similar to where like(field1, %field2%), but I'm not sure how to make that happen as field2 is a variable.

0 Karma

sundareshr
Legend

Try creating a new var with the pattern. Like this ... | eval pattern="%".field2."%" | where like(field1, pattern)

somesoni2
Revered Legend

You can just use it in place, new field creation not required.

... | where like(field1, "%".field2."%")
0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...