Using like() not working in where statement

[bpna]

I have an alerts index which has a data.rule.name field containing the following values:

COVID-19 linked Cyber Attacks (Social Media)	2	40%
Global Trends, Trending Targets	1	20%
Locations by Risk Level	1	20%
Target Trends, Trending Targets in Watch List	1	20%

I would like to filter events to only include ones where data.rule.name begins with "Target Trends..."

My SPL is as follows:

index=alerts
| where like(data.rule.name, "Target Trends.%")

This produces 0 events. Am I using this function wrong?

[bowesmana]

@bpna 

When using field names in statements that take an eval expression, like the where clause does, you will need to escape fields that do not contain 'simple' characters. In practice this means that any field starting with a numeric, or not contain only numbers and letters will need to be escaped by wrapping the field in single quotes, e.g.

| where like('data.rule.name', "Target Trends.%")

in this case, the . character needs to be escaped. See these links for a description (although they are SLP2, they apply here also)

https://docs.splunk.com/Documentation/SCS/current/Search/Escapecharacters#Rules_for_when_to_use_esca...

https://docs.splunk.com/Documentation/SCS/current/Search/Quotations

[bpna]

I was able to solve this by putting the condition in the first line of the search, like this:

index=alerts data.rule.name="Target Trends, Trending Targets in Watch List"

It still bugs me that

| where like()

isn't working the way I'd expect it to, if anyone has advice I am all ears!