Splunk search - How to search the fields1 values contains in field2

[kartm2020]

Hi All, Hope you guys are doing fine.
I do have few doubts with relates to field comparison. Please find the below sample data.

Field1	Field2
TRAP_BGP	BGP BACKWARD TRANSITION
TRAP_BFD	CISCO BFD SESS DOWN
Interface GigabitEthernet0/0	BGP BACKWARD TRANSITION
TRAP_LINK	LINK UP/DOWN TRAPS RECEIVED IN THE LAST 5 MINUTES EXCEEDS THRESHOLD

I need to check the value of field1 is containing in field2(partial match). From the above example, TRAP_BGP and BGP BACKWARD TRANSITION. in this both words BGP is common. if it is common then the result should "YES".

This is sample data, we do have multiple data with this format(This data is dynamic not static).

Can someone please help with the SPL query. I have tried match, LIKE command but it doesn't seems to be working.

[kartm2020]

Hi ITWhisperer,

Thanks a lot for this idea. It worked. but it is not working for some fields.
Ex: Field1=Interface Ethernet1/45 Field2=LINK|UP/DOWN|TRAPS|RECEIVED|IN|THE|LAST|5|MINUTES|EXCEEDS|THRESHOLD
I am getting yes for this scenario. but Interface and ethernet is not present field2. Can you please provide an explanation. Thank you

[ITWhisperer]

"5" exists in both fields

[kartm2020]

Is there any way to find the exact partial match of word.. Like adding condition ?

[ITWhisperer]

I am not sure what you mean by "exact partial" - essentially field 2 needs to have the options delimited by pipe symbols - you could try replacing only some of the spaces if you can define some rules, for example, spaces before and/or after numbers should not be replaced.

[kartm2020]

Hi,

Thanks a lot for your prompt reply and giving me this idea. I will accept your answer.

[ITWhisperer · Accepted solution]

| makeresults
| eval _raw="TRAP_BGP,BGP BACKWARD TRANSITION
TRAP_BFD,CISCO BFD SESS DOWN
Interface GigabitEthernet0/0,BGP BACKWARD TRANSITION
TRAP_LINK,LINK UP/DOWN TRAPS RECEIVED IN THE LAST 5 MINUTES EXCEEDS THRESHOLD"
| multikv noheader=t
| rename Column_* as field*
| table field*



| eval field2=replace(field2," ", "|")
| eval match=if(match(field1,field2),"yes",null())