Splunk Search
Highlighted

Search for a string containing X

Explorer

Hi there -

I know how to search for parameters/variables that equal X value...but how to I construct a query to look for a parameter/variable containing ______?

For instance - instead of "itemId=1234", I want to search for "itemId CONTAINS 23".

Hopefully this makes sense! 🙂

Thanks in advance for your help!

Tags (2)
Highlighted

Re: Search for a string containing X

Builder

What about
itemId=$23$

Except replace $ with * .... it won't let me put wildcards around 23 because of comment formatting

View solution in original post

Highlighted

Re: Search for a string containing X

Explorer

Hi @dflodstrom - thanks for your feedback!

Using:

itemId=23

...will search for the parameter/variable of "itemId" only containing the value of "23". That's not what I'm trying to do here.

I'm trying to search for a parameter that contains a value...but is not limited to ONLY that value (i.e. - does not have to EQUAL that value).

Hopefully that's a bit more clear 🙂

0 Karma
Highlighted

Re: Search for a string containing X

Explorer

Thank you @dflodstrom ! it looks like that does the trick 😄