Is there a way to check if a field value is present in a transaction?

[jluo_splunk]

The transaction command has the options startswith and endswith, but is there a "contains" of some sort that can be used, just to say that somewhere in the transaction there should be some field value?

[MattZerfas · Accepted solution]

I have used a regex in a match statement before like below and it seems to work fine. Maybe try that?

startswith=eval(match(eventName,".*SkipFwd"))

[MattZerfas]

O then you could just do a |search foo=bar or |where foo=bar after your transaction depending on what you are wanting to look for.

[jluo_splunk]

That did it - thank you MattZerfas!

[jluo_splunk]

My issue is I don't necessarily want it to start with this field value. I just want to check that the field value is somewhere in there, not necessarily the beginning or the end.

[javiergn]

Is this what you are talking about?

startswith=eval(match(yourfield,"yourvalue"))
endswith=eval(match(yourfield,"yourvalue"))

You can use regex too or even conditionals inside your eval.
See transaction reference help page.

[jluo_splunk]

My issue is I don't necessarily want it to start with this field value. I just want to check that the field value is somewhere in there, not necessarily the beginning or the end.