check if stringa in stingb

[mcohen13]

how can i make a case condition to check if StingA is in StringB?

for example StingA is "xxx.com." StingB is: "a.xxx.com."

[jkat54]

Try this:

... | eval match=if(like(fieldB,fieldA),1,0) | search match=1

[mcohen13]

if the list of domains are not in a field but in a lookup table, how does that change the query?

for example:
i have a list of domain in a lookup table
and i have a list of domain in a field

and i want to check if the list of domains in the field are in the lookup table

[jkat54]

In that case...

... | rename domain as domainFromIndex 
| inputlookup lookupName domain as domain OUTPUTNEW domainFromLookup
| eval match=if(domainFromIndex=domainFromLookup,1,0)
| where match=1