Splunk Search

how to match partial string in search query

sravankaripe
Communicator

Hi

I have a errors in the field (say myfield)

Error xyz : 123
Error xyz : 456
Error xyz : 789
Error xyz : 135
Error xyz : 987

i want to group it by matching the partial values of a string like
| eval myfield=if(myfield=="Error xyz*","Error xyz",myfield)

So myfields should contain values

"Error xyz" and other errors
(i am tring to group myfield values which starts with "Error xyz" )
how can i do this

Tags (2)
0 Karma
1 Solution

SplunkersRock
Path Finder

try this

| eval temp= mvfilter(match(myfield,"Error xyz")) | eval myfield=if(myfield==temp,"Error xyz",myfield)

if it won't work, please provide me more info

View solution in original post

SplunkersRock
Path Finder

try this

| eval temp= mvfilter(match(myfield,"Error xyz")) | eval myfield=if(myfield==temp,"Error xyz",myfield)

if it won't work, please provide me more info

Get Updates on the Splunk Community!

Customer Experience | Splunk 2024: New Onboarding Resources

In 2023, we were routinely reminded that the digital world is ever-evolving and susceptible to new ...

Celebrate CX Day with Splunk: Take our interactive quiz, join our LinkedIn Live ...

Today and every day, Splunk celebrates the importance of customer experience throughout our product, ...

How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

If you want to gain full control over your growing data volumes, check out Splunk’s Data Management pipeline ...