Splunk Search

Nesting functions in 'where' in 4.3

gmor
Explorer

Hi,

Very quick question that someone may be able to answer.

In a complex form search that we have, we use the 'where' function to filter the results. So that the data is case-insensitive, we use the 'lower' function.

In version 4.2.5, this syntax works fine:

where like(lower(Room),lower("%MB.1%"))

('Room' is a field in the search, the other data is user entered so can vary wildly)

In version 4.3, I get the error:

"Error in 'where' command: The arguments to the 'like' function are invalid."

Is this an error, or can we no longer nest functions?

Any advice or suggestions would be appreciated.

Thanks,

Graham.

Tags (2)
0 Karma

woodcock
Esteemed Legend

It works in v6 but why are you lowering your match string; why not just lower it yourself like this:

where like(lower(Room),"%mb.1%"))

Assuming that there actually is some valid reason for needing this (e.g. you are using a $token$ for the match string), switch from SQL-type like to RegEx-type match and use the ignorecase inline token like this:

where match(lower(Room),"(?i)MB.1"))
0 Karma

gmor
Explorer

Hi. Wow, this takes me back a few years...

Thanks for your answer.

Yes, the question did relate to the use of a $token$ in an Advanced XML View. Otherwise yes, I get that I could turn off Cap Lock and type the string in lowercase(!)

But thank you for the suggestion of using the match function. I hadn't come across it before and I think it will prove useful in a number of different situations.

0 Karma

woodcock
Esteemed Legend

I am mining older unanswered questions for karma so please accept my answer. I am glad it was at least educational, if it could not be useful.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...