Splunk Search

How to write a search to determine if the value of one field is found in the value of another field?

olheiser01
New Member

I am trying to return a result when one field contains another. For example,

field1="ABCDEFG"
field2="CDE"

Match= True

I wanted to try something similar to where like(field1, %field2%), but I'm not sure how to make that happen as field2 is a variable.

0 Karma

sundareshr
Legend

Try creating a new var with the pattern. Like this ... | eval pattern="%".field2."%" | where like(field1, pattern)

somesoni2
Revered Legend

You can just use it in place, new field creation not required.

... | where like(field1, "%".field2."%")
0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...