Hello I have two similar strings that I need to differentiate. These are the key words in the String 1. Special 2 Specialist When they come into Splunk it comes in as a command: EX: "Alter User Special" "Alter User Specialist" Currently I am using these queries: host=*| eval SPECIALIST=if(like(EVNTCOMMAND, "% SPECIALIST%"),1,0)| chart sum(SPECIALIST) host=*| eval SPECIAL=if(like(EVNTCOMMAND, "% SPECIAL%"),1,0)| chart sum(SPECIAL) I need the % after Special and Specialist because sometimes there is more data after those strings. Any Suggestions? Thank you, Marco
... View more