subsearch query

[brenisro]

I have the following query that works fine.

index=pdv OrgId=* | rex field=request_id "SearchString=(?[^\d].*?)\|.*$" | search PatientName=* | rex field=PatientName "(?.*?)[ ,](?.*)" | rex field=client_id "UserId=(?\d+)" | lookup company_administration-user user_id OUTPUT user_name first_name AS u_first last_name AS u_last | table _time OrgId user_name u_first u_last p_first p_last

I want to add a subsearch that looks for all occurrences where p_last is within user_name. I don't know how to adjust the query to get this result - can anyone help please? In other words - user_name is an email address and p_last is a users last name. I want to know when a users last name is within the email address.

thank you.

[somesoni2]

Try adding following to end of your search

Your current search | eval HasLastNameInEmail=if(like(user_name,"%".p_last."%"),"Yes","No")

[brenisro]

Thank you very much - that works perfectly!!