Splunk Search

Using like() not working in where statement

bpna
Explorer

I have an alerts index which has a data.rule.name field containing the following values:

COVID-19 linked Cyber Attacks (Social Media)240%
 
Global Trends, Trending Targets120%
 
Locations by Risk Level120%
 
Target Trends, Trending Targets in Watch List120%

 

I would like to filter events to only include ones where data.rule.name begins with "Target Trends..."

My SPL is as follows:

index=alerts
| where like(data.rule.name, "Target Trends.%")

This produces 0 events. Am I using this function wrong?

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

@bpna 

When using field names in statements that take an eval expression, like the where clause does, you will need to escape fields that do not contain 'simple' characters. In practice this means that any field starting with a numeric, or not contain only numbers and letters will need to be escaped by wrapping the field in single quotes, e.g.

| where like('data.rule.name', "Target Trends.%")

in this case, the . character needs to be escaped. See these links for a description (although they are SLP2, they apply here also)

https://docs.splunk.com/Documentation/SCS/current/Search/Escapecharacters#Rules_for_when_to_use_esca...

https://docs.splunk.com/Documentation/SCS/current/Search/Quotations

0 Karma

bpna
Explorer

I was able to solve this by putting the condition in the first line of the search, like this:

index=alerts data.rule.name="Target Trends, Trending Targets in Watch List"

It still bugs me that

| where like()

isn't working the way I'd expect it to, if anyone has advice I am all ears!

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...