Search for all events that has part of a string in a field

[ram_sistla]

I am looking for how to search for all events where a field might have values of sub-string.

For Example if I have a string abc123 and the test_data field has the below values

ab
abc
12
ab1
bc2

Expected result after search is

ab

abc
12

[praphulla1]

You can use any string comparison functions or use a wild character to match your search criteria

search  test_data=ab*

Refer to the string comparison functions @ https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/ConditionalFunctions

[Sukisen1981]

The like operator is your friend

|where like (searchstring,"tesdatafield%") OR like(searchstring,"%tesdatafield") OR like(searchstring,"%tesdatafield%")

Here search string is abc123 and the 3 combinations of OR make sure to search for - starts with, ends with or contains

[Sukisen1981]

hi @ram_sistla
Please let us know if your issue has been resolved and accept the answer if it significantly helped your resolution. Do not forget to add additional resolution details for the benefit of other form members.