Solved: Re: using field name in like command - Splunk Community

Splunk Search

host=dummy | eval Pattern='arb_usg_mps%06' | where like (source,'%Pattern%')
doesnot work . can you help what's wrong in this? But events do exists.

1 Solution

Solution

This should work (you had extra spaces and other small problems)

| makeresults | eval source="fooarb_usg_mpsbar06foobar::fooarb_usg_mpsbar07foobar"
| makemv delim="::" source
| mvexpand source

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| eval Pattern="%arb_usg_mps%06%"
| where like(source, Pattern)

View solution in original post

Solution

This should work (you had extra spaces and other small problems)

| makeresults | eval source="fooarb_usg_mpsbar06foobar::fooarb_usg_mpsbar07foobar"
| makemv delim="::" source
| mvexpand source

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| eval Pattern="%arb_usg_mps%06%"
| where like(source, Pattern)

Thanks it worked:)

Get Updates on the Splunk Community!

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...