<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Why &amp;amp;quot;match&amp;amp;quot; condition is not working? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Why-amp-quot-match-amp-quot-condition-is-not-working/m-p/622945#M107199</link>
    <description>&lt;P&gt;I want to match one field value with other field values. If Value in btc field is present in NEB_Sales_Oppy_Business_Type I should get True otherwise False. I tried with the following query:&lt;/P&gt;&lt;P&gt;| eval Is_businees_type_matching=if(match(NEB_Sales_Oppy_Business_Type, btc), "TRUE", "FALSE")&lt;/P&gt;&lt;P&gt;Why I am getting False for 3 rows even the value is available in both fields.&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="splunk_doubt.PNG" style="width: 831px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/22796iA2E3FE791A88BA64/image-size/large?v=v2&amp;amp;px=999" role="button" title="splunk_doubt.PNG" alt="splunk_doubt.PNG" /&gt;&lt;/span&gt;&lt;/P&gt;</description>
    <pubDate>Fri, 02 Dec 2022 05:44:56 GMT</pubDate>
    <dc:creator>punithsj96</dc:creator>
    <dc:date>2022-12-02T05:44:56Z</dc:date>
    <item>
      <title>Why &amp;quot;match&amp;quot; condition is not working?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Why-amp-quot-match-amp-quot-condition-is-not-working/m-p/622945#M107199</link>
      <description>&lt;P&gt;I want to match one field value with other field values. If Value in btc field is present in NEB_Sales_Oppy_Business_Type I should get True otherwise False. I tried with the following query:&lt;/P&gt;&lt;P&gt;| eval Is_businees_type_matching=if(match(NEB_Sales_Oppy_Business_Type, btc), "TRUE", "FALSE")&lt;/P&gt;&lt;P&gt;Why I am getting False for 3 rows even the value is available in both fields.&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="splunk_doubt.PNG" style="width: 831px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/22796iA2E3FE791A88BA64/image-size/large?v=v2&amp;amp;px=999" role="button" title="splunk_doubt.PNG" alt="splunk_doubt.PNG" /&gt;&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Fri, 02 Dec 2022 05:44:56 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Why-amp-quot-match-amp-quot-condition-is-not-working/m-p/622945#M107199</guid>
      <dc:creator>punithsj96</dc:creator>
      <dc:date>2022-12-02T05:44:56Z</dc:date>
    </item>
    <item>
      <title>Re: Why &amp;quot;match&amp;quot; condition is not working?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Why-amp-quot-match-amp-quot-condition-is-not-working/m-p/622953#M107202</link>
      <description>&lt;P&gt;Hi &lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/247676"&gt;@punithsj96&lt;/a&gt;&lt;/P&gt;&lt;P&gt;can you swap the fields in match and try it?&lt;BR /&gt;&lt;BR /&gt;&lt;SPAN&gt;| eval Is_businees_type_matching=if(match(btc,NEB_Sales_Oppy_Business_Type), "TRUE", "FALSE")&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Fri, 02 Dec 2022 06:37:44 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Why-amp-quot-match-amp-quot-condition-is-not-working/m-p/622953#M107202</guid>
      <dc:creator>SanjayReddy</dc:creator>
      <dc:date>2022-12-02T06:37:44Z</dc:date>
    </item>
    <item>
      <title>Re: Why &amp;quot;match&amp;quot; condition is not working?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Why-amp-quot-match-amp-quot-condition-is-not-working/m-p/622954#M107203</link>
      <description>&lt;P&gt;The problems is that the match string is a regex, so if btc would need to be&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;New Equipment \(NEB\)&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;for the match to work. See this example&lt;/P&gt;&lt;P&gt;| makeresults&lt;BR /&gt;| fields - _time&lt;BR /&gt;| eval NEB_Sales_Oppy_Business_Type="New Equipment (NEB)|Modernization (FRB)|Modernization (TRB)", btc="New Equipment (NEB)", btc1="New Equipment \(NEB\)"&lt;BR /&gt;| eval Is_businees_type_matching=if(match(NEB_Sales_Oppy_Business_Type, btc), "TRUE", "FALSE")&lt;BR /&gt;| eval Is_businees_type_matching1=if(match(NEB_Sales_Oppy_Business_Type, btc1), "TRUE", "FALSE")&lt;/P&gt;</description>
      <pubDate>Fri, 02 Dec 2022 06:53:21 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Why-amp-quot-match-amp-quot-condition-is-not-working/m-p/622954#M107203</guid>
      <dc:creator>bowesmana</dc:creator>
      <dc:date>2022-12-02T06:53:21Z</dc:date>
    </item>
    <item>
      <title>Re: Why &amp;quot;match&amp;quot; condition is not working?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Why-amp-quot-match-amp-quot-condition-is-not-working/m-p/622955#M107204</link>
      <description>&lt;P&gt;Hi &lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/236694"&gt;@SanjayReddy&lt;/a&gt;&lt;/P&gt;&lt;P&gt;Thanks for your response, I tried still its not working.&lt;/P&gt;</description>
      <pubDate>Fri, 02 Dec 2022 06:54:40 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Why-amp-quot-match-amp-quot-condition-is-not-working/m-p/622955#M107204</guid>
      <dc:creator>punithsj96</dc:creator>
      <dc:date>2022-12-02T06:54:40Z</dc:date>
    </item>
    <item>
      <title>Re: Why &amp;quot;match&amp;quot; condition is not working?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Why-amp-quot-match-amp-quot-condition-is-not-working/m-p/622958#M107205</link>
      <description>&lt;P&gt;Try replacing the open and close brackets in the btc field&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| eval Is_business_type_matching=if(match(NEB_Sales_Oppy_Business_Type, replace(replace(btc,"\)","\)"),"\(","\(")), "TRUE", "FALSE")&lt;/LI-CODE&gt;</description>
      <pubDate>Fri, 02 Dec 2022 06:59:35 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Why-amp-quot-match-amp-quot-condition-is-not-working/m-p/622958#M107205</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2022-12-02T06:59:35Z</dc:date>
    </item>
    <item>
      <title>Re: Why &amp;quot;match&amp;quot; condition is not working?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Why-amp-quot-match-amp-quot-condition-is-not-working/m-p/622963#M107209</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/6367"&gt;@bowesmana&lt;/a&gt;, thanks for your response its working now as per my requirement.&lt;/P&gt;</description>
      <pubDate>Fri, 02 Dec 2022 07:15:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Why-amp-quot-match-amp-quot-condition-is-not-working/m-p/622963#M107209</guid>
      <dc:creator>punithsj96</dc:creator>
      <dc:date>2022-12-02T07:15:32Z</dc:date>
    </item>
    <item>
      <title>Re: Why &amp;quot;match&amp;quot; condition is not working?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Why-amp-quot-match-amp-quot-condition-is-not-working/m-p/622965#M107210</link>
      <description>&lt;P&gt;Hi &lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168"&gt;@ITWhisperer&lt;/a&gt; , yes its also working thanks for the support and response.&lt;/P&gt;</description>
      <pubDate>Fri, 02 Dec 2022 07:19:55 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Why-amp-quot-match-amp-quot-condition-is-not-working/m-p/622965#M107210</guid>
      <dc:creator>punithsj96</dc:creator>
      <dc:date>2022-12-02T07:19:55Z</dc:date>
    </item>
  </channel>
</rss>

