using field name in like command

[smuderasi]

host=dummy | eval Pattern='arb_usg_mps%06' | where like (source,'%Pattern%')
doesnot work . can you help what's wrong in this? But events do exists.

[woodcock · Accepted solution]

This should work (you had extra spaces and other small problems)

| makeresults | eval source="fooarb_usg_mpsbar06foobar::fooarb_usg_mpsbar07foobar"
| makemv delim="::" source
| mvexpand source

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| eval Pattern="%arb_usg_mps%06%"
| where like(source, Pattern)

[smuderasi]

Thanks it worked:)