Splunk Search

How to write a search to determine if the value of one field is found in the value of another field?

olheiser01
New Member

I am trying to return a result when one field contains another. For example,

field1="ABCDEFG"
field2="CDE"

Match= True

I wanted to try something similar to where like(field1, %field2%), but I'm not sure how to make that happen as field2 is a variable.

0 Karma

sundareshr
Legend

Try creating a new var with the pattern. Like this ... | eval pattern="%".field2."%" | where like(field1, pattern)

somesoni2
Revered Legend

You can just use it in place, new field creation not required.

... | where like(field1, "%".field2."%")
0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...