Splunk Search

Need to escape % using LIKE.

New Member

In my where command I need to use LIKE to match a string containing %. Something like this:

... | where LIKE(myField, "match % this") | ...

I need a literal match on "match % this", to exclude something like "match other things but not this".

So, any thoughts on how to find a literal "%"?

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Use the match function. It takes regular expressions.

| where match(myField, "match % this")

Docs here.

View solution in original post

Splunk Employee
Splunk Employee

Using search instead of where will give you the solution, here.

| search myfield="match % this"
0 Karma

Splunk Employee
Splunk Employee

Use the match function. It takes regular expressions.

| where match(myField, "match % this")

Docs here.

View solution in original post