I have the following query that works fine.
index=pdv OrgId=* | rex field=request_id "SearchString=(?[^\d].*?)\|.*$" | search PatientName=* | rex field=PatientName "(?.*?)[ ,](?.*)" | rex field=client_id "UserId=(?\d+)" | lookup company_administration-user user_id OUTPUT user_name first_name AS u_first last_name AS u_last | table _time OrgId user_name u_first u_last p_first p_last
I want to add a subsearch that looks for all occurrences where p_last is within user_name. I don't know how to adjust the query to get this result - can anyone help please? In other words - user_name is an email address and p_last is a users last name. I want to know when a users last name is within the email address.
thank you.
Try adding following to end of your search
Your current search | eval HasLastNameInEmail=if(like(user_name,"%".p_last."%"),"Yes","No")
Thank you very much - that works perfectly!!