Splunk Search

Using like() not working in where statement

bpna
Explorer

I have an alerts index which has a data.rule.name field containing the following values:

COVID-19 linked Cyber Attacks (Social Media)240%
 
Global Trends, Trending Targets120%
 
Locations by Risk Level120%
 
Target Trends, Trending Targets in Watch List120%

 

I would like to filter events to only include ones where data.rule.name begins with "Target Trends..."

My SPL is as follows:

index=alerts
| where like(data.rule.name, "Target Trends.%")

This produces 0 events. Am I using this function wrong?

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

@bpna 

When using field names in statements that take an eval expression, like the where clause does, you will need to escape fields that do not contain 'simple' characters. In practice this means that any field starting with a numeric, or not contain only numbers and letters will need to be escaped by wrapping the field in single quotes, e.g.

| where like('data.rule.name', "Target Trends.%")

in this case, the . character needs to be escaped. See these links for a description (although they are SLP2, they apply here also)

https://docs.splunk.com/Documentation/SCS/current/Search/Escapecharacters#Rules_for_when_to_use_esca...

https://docs.splunk.com/Documentation/SCS/current/Search/Quotations

0 Karma

bpna
Explorer

I was able to solve this by putting the condition in the first line of the search, like this:

index=alerts data.rule.name="Target Trends, Trending Targets in Watch List"

It still bugs me that

| where like()

isn't working the way I'd expect it to, if anyone has advice I am all ears!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...