<title>Routers</title>
| dbquery "routerdb" "SELECT DEVICE_LOC FROM routerdb.LKP_LOCATION_EDITED WHERE METRO_CITY LIKE '%Philadelphia%'"
| stats count by DEVICE_LOC
| fields - count
| rename DEVICE_LOC AS ROUTER
| format
Outputs: ( ( ROUTER="PHIL" ) OR ( ROUTER="PHL02" ) OR ( ROUTER="PHL23" ) OR ( ROUTER="PHL24" ) OR ( ROUTER="PHL6" ) OR ( ROUTER="PHL8" ) OR ( ROUTER="PHLAPA" ) )
How would I make it so it would be like (ROUTER LIKE "PHIL%") with the "%" wildcard? I'm trying to use these router prefixes to find all routers with that prefix. Thanks in advance!
Like this
| dbquery "routerdb" "SELECT DEVICE_LOC FROM routerdb.LKP_LOCATION_EDITED WHERE METRO_CITY LIKE '%Philadelphia%'"
| stats count by DEVICE_LOC
| fields - count
| eval ROUTER=DEVICE_LOC."%"
| fields ROUTER
| format
| eval search=replace(search, "=", " LIKE ")