Splunk Search

Is there a way to check if a field value is present in a transaction?

jluo_splunk
Splunk Employee
Splunk Employee

The transaction command has the options startswith and endswith, but is there a "contains" of some sort that can be used, just to say that somewhere in the transaction there should be some field value?

0 Karma
1 Solution

MattZerfas
Communicator

I have used a regex in a match statement before like below and it seems to work fine. Maybe try that?

startswith=eval(match(eventName,".*SkipFwd"))

View solution in original post

0 Karma

MattZerfas
Communicator

I have used a regex in a match statement before like below and it seems to work fine. Maybe try that?

startswith=eval(match(eventName,".*SkipFwd"))
0 Karma

MattZerfas
Communicator

O then you could just do a |search foo=bar or |where foo=bar after your transaction depending on what you are wanting to look for.

jluo_splunk
Splunk Employee
Splunk Employee

That did it - thank you MattZerfas!

jluo_splunk
Splunk Employee
Splunk Employee

My issue is I don't necessarily want it to start with this field value. I just want to check that the field value is somewhere in there, not necessarily the beginning or the end.

0 Karma

javiergn
Super Champion

Is this what you are talking about?

startswith=eval(match(yourfield,"yourvalue"))
endswith=eval(match(yourfield,"yourvalue"))

You can use regex too or even conditionals inside your eval.
See transaction reference help page.

0 Karma

jluo_splunk
Splunk Employee
Splunk Employee

My issue is I don't necessarily want it to start with this field value. I just want to check that the field value is somewhere in there, not necessarily the beginning or the end.

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...