Splunk Search

using field name in like command

smuderasi
Explorer

host=dummy | eval Pattern='arb_usg_mps%06' | where like (source,'%Pattern%')
doesnot work . can you help what's wrong in this? But events do exists.

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

This should work (you had extra spaces and other small problems)

| makeresults | eval source="fooarb_usg_mpsbar06foobar::fooarb_usg_mpsbar07foobar"
| makemv delim="::" source
| mvexpand source

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| eval Pattern="%arb_usg_mps%06%"
| where like(source, Pattern)

View solution in original post

woodcock
Esteemed Legend

This should work (you had extra spaces and other small problems)

| makeresults | eval source="fooarb_usg_mpsbar06foobar::fooarb_usg_mpsbar07foobar"
| makemv delim="::" source
| mvexpand source

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| eval Pattern="%arb_usg_mps%06%"
| where like(source, Pattern)

smuderasi
Explorer

Thanks it worked:)

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...