to search and show a string in the same field.

[fasantos]

Dears,

I would like to search and show a string in the field that contains multiples values. Ex.: In the IP field, there are multiples IPs as below :

IP field
10.XXX.XXX.XXX 200.XXX.XXX.XXX

I would like to search only IPs that start with "200.". Until now i've used the syntaxe "| where like(IP,"%200.%") ". But, i need to show only the IP that start with "200." to do outer join with another search.

Can you help me?

[somesoni2 · Accepted solution]

Assuming that these IP's are separated by space, you can convert them to multi valued field and then filter them for specific IP. Something like this

Your base search | makemv IP_field delim=" " | eval IP_field=mvfilter(match(IP_field,"^200\")) | ...you got your IP_field filtered with just the IP's starting with 200.

[fasantos]

Perfect. I reproduced this orientation and it's correct.

Thanks so much.

Regards,
Fábio Augusto