Splunk Search

transaction startswith match not exact


I noticed that the "startswith" expression does not match exactly.

startswith="Sophos Anti-Virus service entered the stopped"

The statement above created transactions containing this string:

Message=The Sophos Anti-Virus Statusreporter service entered the stopped state.

Notice that the word "Statusreporter" does not appear in the string defined as the start of the transaction. Is there a way to make it match exactly?


Sending escaped quotes to the searchmatch function of eval worked for me:

startswith=eval(searchmatch"\"Sophos Anti-Virus service entered the stopped\""))
0 Karma

Path Finder

Is the text in a field? If so an eval expression would be one solution
startswith=eval(thefieldname=="Sophos Anti-Virus service entered the stopped")
If there's further text in the field following this phrase you could use a wildcard at the end.
"Sophos Anti-Virus service entered the stopped*"
If it's not a pre-defined (persistent) field you could use rex or erex to create a transient field before the transaction command and use that in the startswith/ eval.

0 Karma