Splunk Search

how to match partial string in search query

sravankaripe
Communicator

Hi

I have a errors in the field (say myfield)

Error xyz : 123
Error xyz : 456
Error xyz : 789
Error xyz : 135
Error xyz : 987

i want to group it by matching the partial values of a string like
| eval myfield=if(myfield=="Error xyz*","Error xyz",myfield)

So myfields should contain values

"Error xyz" and other errors
(i am tring to group myfield values which starts with "Error xyz" )
how can i do this

Tags (2)
0 Karma
1 Solution

SplunkersRock
Path Finder

try this

| eval temp= mvfilter(match(myfield,"Error xyz")) | eval myfield=if(myfield==temp,"Error xyz",myfield)

if it won't work, please provide me more info

View solution in original post

SplunkersRock
Path Finder

try this

| eval temp= mvfilter(match(myfield,"Error xyz")) | eval myfield=if(myfield==temp,"Error xyz",myfield)

if it won't work, please provide me more info

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...