Splunk Search

Need to escape % using LIKE.

dawfun
New Member

In my where command I need to use LIKE to match a string containing %. Something like this:

... | where LIKE(myField, "match % this") | ...

I need a literal match on "match % this", to exclude something like "match other things but not this".

So, any thoughts on how to find a literal "%"?

0 Karma
1 Solution

aljohnson_splun
Splunk Employee
Splunk Employee

Use the match function. It takes regular expressions.

| where match(myField, "match % this")

Docs here.

View solution in original post

ldongradi_splun
Splunk Employee
Splunk Employee

Using search instead of where will give you the solution, here.

| search myfield="match % this"
0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Use the match function. It takes regular expressions.

| where match(myField, "match % this")

Docs here.

Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...