can i use "like" in search criteria

[alexl1]

if one of my fields is host, I want to do

host like "startswith*"

what is the syntax to do that? thanks,

[pranjal]

whats the best way to compare with a list of items.
I am looking for something like this:
|search where NotificationEventType in ("THE_CHEESEBURGER%", "THE_HAMBURGER%", "ETC%"...)

[th1agarajan]

@bcherdak : What is the best way to exclude event that start with foo*?

your search | where NOT like(host,"foo%")

This should do the magic.

[ddrillic]

-- bcherdak, you asked - "What is the best way to exclude event that start with foo*?"

I would say - ... NOT host = "foo*"

[jtacy]

While it's probably safe to use NOT host="foo*" since the host field should always exist, I'd favor the host!="foo*" syntax; if you have a pattern you're matching on, you probably expect that field to exist in the results. Using the NOT approach will also return events that are missing the field which is probably not what most people want.

[JSapienza · Accepted solution]

Here are are a couple ways.

1. host=foo*

2. ... | where like(host, "foo%")

[alexl1]

thanks! ...

[pranjal]

whats the best way to compare with a list of items.
I am looking for something like this:
|search where NotificationEventType in ("THE_CHEESEBURGER%", "THE_HAMBURGER%", "ETC%"...)

[bcherdak]

What is the best way to exclude event that start with foo*?

[jtacy]

If you want to exclude events where a field doesn't start with foo*, use field!="foo*".

If you want to exclude events where the event itself doesn't start with foo*, you can use _raw!="foo*".