Splunk Search

How to match a partial string in search

himanshu_b_shek
New Member

Hi,
I have a field called CommonName, sample value of CommonName are below:

  1. CommonName = xyz.apac.ent.bhpbilliton.net
  2. CommonName = xyz.ent.bhpbilliton.net
  3. CommonName = xyz.emea.ent.bhpbilliton.net
  4. CommonName = xyz.abc.ent.bhpbilliton.net

I want to match 2nd value ONLY I am using- CommonName like "%.ent.bhpbilliton.net", it gives all above-listed CommonName.
I want to select only 2nd one, Please advice here.

Thanks in advance.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The % character in the match function matches everything. Since your four sample values all end with the string in your match they all match. To have a more specific matching pattern, you'll need to use a regular expression in the like function like this:

... | where like(CommonName, "^[^\.]+\.*\.ent\.bhpbilliton\.net") | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

Vijeta
Influencer

You can use your query like this..

<your index search>| rex field=CommonName "\w+.(?<str>\w+.\w+.\w+)"| where str="ent.bhpbilliton.net"

richgalloway
SplunkTrust
SplunkTrust

The % character in the match function matches everything. Since your four sample values all end with the string in your match they all match. To have a more specific matching pattern, you'll need to use a regular expression in the like function like this:

... | where like(CommonName, "^[^\.]+\.*\.ent\.bhpbilliton\.net") | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

himanshu_b_shek
New Member

Thank you so much , it worked 🙂

0 Karma

himanshu_b_shek
New Member

Hi ,
I am trying to use like this -
| eval access=if(((occurrences>1 OR Request_EMail like "dl-%@%.com" ) AND (Request_CommonName like "^[^.]+.*.ent.bhpbilliton.net") ) , "Grant" , "Reject")

But here it goes to access= "Reject" , how I can use this in eval .

Thank you

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...