Splunk Search

Join on indexed value with a wildcard

Cuyose
Builder

I am trying to join on indexed data where I want to have something like 123 join with 123 and also 123-14XXx

Where 123 is variable. I can't seem to figure out what to use here, basically the logic is if there is a dash, strip it and everything after it off before attempting the join.

Any ideas?

Tags (3)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You should probably use the "eval" or "rex" commands to create a new field with the subvalue you want, then join against that field.

Get Updates on the Splunk Community!

Fall Into Learning with New Splunk Education Courses

Every month, Splunk Education releases new courses to help you branch out, strengthen your data science roots, ...

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...