Splunk Search

field value as a search pattern for filtering

Arvids
Loves-to-Learn

I have got table, which contains field SSS with search patterns and another field FFF, to which I want apply search patterns in order to get records with matches.

Something like:
SSS                  FFF
*Tomcat*       /opt/app/tomcat/
*jquery*          libxml2-2.9.1-6.el7.5.x86_64
*                         Package Installed Version Required Version python-perf
*jquery*           jQuery Version Prior to 3.5.0

Can't figure out case insensitive solution, which will return the first, third and fourth record.

Labels (1)
0 Karma

Arvids
Loves-to-Learn

At the end of day I came to dirty workaround 🙂 Will leave comment here, may be it will help to somebody.

I used | eval EEE=if(match(FFF,".*".SSS.".*"), 1,0) to indicate matches, but had to change SSS field wildcards, thankfully it was made by semimanual CSV.  Match function uses regex, so I had to remove * wildcards before and especially after, replace all * by .* and shorten search words to exclude potential capital letters - like omcat or uery ). As you can see, solution is still case insensitive, so feel free to offer improvements.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...