I am trying to return a result when one field contains another. For example,
field1="ABCDEFG"
field2="CDE"
Match= True
I wanted to try something similar to where like(field1, %field2%)
, but I'm not sure how to make that happen as field2 is a variable.
Try creating a new var with the pattern. Like this ... | eval pattern="%".field2."%" | where like(field1, pattern)
You can just use it in place, new field creation not required.
... | where like(field1, "%".field2."%")