I am looking for how to search for all events where a field might have values of sub-string.
For Example if I have a string abc123 and the test_data field has the below values
ab
abc
12
ab1
bc2
Expected result after search is
ab
abc
12
You can use any string comparison functions or use a wild character to match your search criteria
search test_data=ab*
Refer to the string comparison functions @ https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/ConditionalFunctions
The like operator is your friend
|where like (searchstring,"tesdatafield%") OR like(searchstring,"%tesdatafield") OR like(searchstring,"%tesdatafield%")
Here search string is abc123 and the 3 combinations of OR make sure to search for - starts with, ends with or contains
hi @ram_sistla
Please let us know if your issue has been resolved and accept the answer if it significantly helped your resolution. Do not forget to add additional resolution details for the benefit of other form members.