String compare regex wildcard

darioapis · ‎01-31-2019

(( host="vwp054" AND source="E:\\Apache\\apisit\\*"))  | eval site = if(match(source,"E:\A.*"),1,0)  | eval aba = if(source=="E:\\Apache\\apisit\\*",1,0)

I want "aba" to be one, or "site" to be one, but splunk gives me zero. I guess that probably I can't use *(wildcard) in string comparison or not even in match function. Can you help me specify the string comparison expression.

vishaltaneja070 · ‎01-31-2019

Try this:

| makeresults  | eval source="E:\\Apache\\apisit\\*" | eval site = if (source like "E:\A%",1,0) | eval api = if(source like "E:\Apache\a%",1,0)

String compare regex wildcard

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

At .conf26, Don’t Just See What’s Next. Help Shape It at Innovation Labs.

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF

Data Management Digest – August 2026

Join the Conversation

String compare regex wildcard

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

At .conf26, Don’t Just See What’s Next. Help Shape It at Innovation Labs.

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF

Data Management Digest – August 2026