Hi,
I have a field called CommonName, sample value of CommonName are below:
I want to match 2nd value ONLY I am using- CommonName like "%.ent.bhpbilliton.net", it gives all above-listed CommonName.
I want to select only 2nd one, Please advice here.
Thanks in advance.
The %
character in the match
function matches everything. Since your four sample values all end with the string in your match
they all match. To have a more specific matching pattern, you'll need to use a regular expression in the like
function like this:
... | where like(CommonName, "^[^\.]+\.*\.ent\.bhpbilliton\.net") | ...
You can use your query like this..
<your index search>| rex field=CommonName "\w+.(?<str>\w+.\w+.\w+)"| where str="ent.bhpbilliton.net"
The %
character in the match
function matches everything. Since your four sample values all end with the string in your match
they all match. To have a more specific matching pattern, you'll need to use a regular expression in the like
function like this:
... | where like(CommonName, "^[^\.]+\.*\.ent\.bhpbilliton\.net") | ...
Thank you so much , it worked 🙂
Hi ,
I am trying to use like this -
| eval access=if(((occurrences>1 OR Request_EMail like "dl-%@%.com" ) AND (Request_CommonName like "^[^.]+.*.ent.bhpbilliton.net") ) , "Grant" , "Reject")
But here it goes to access= "Reject" , how I can use this in eval .
Thank you