https://community.splunk.com/t5/Splunk-Search/eval-alerting-on-matching-fields/m-p/399394#M115810 <P>the if statement will return 1 if the fields match else it will return 0</P> <P>| eval match=if(field1_foo==field2_foo,1,0)<BR /> | where match=1</P> <P>If you want to set an alert - save the search where 'match=1' (to get events where the fields are same) as an alert where you can schedule it to run periodically or create a correlation search in Splunk ES to create a notable event.</P> Tue, 29 Sep 2020 22:43:03 GMT saurabhkharkar 2020-09-29T22:43:03Z https://community.splunk.com/t5/Splunk-Search/eval-alerting-on-matching-fields/m-p/399393#M115809 <P>i want to make an alert that will pop when two values in a event match.</P> <PRE><CODE>index=foo_index sourcetype=foofoo_prod| eval match=if(field1_foo==Filed2_foo,1,0) </CODE></PRE> <P>The issues I am not sure of what eval function to use. <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span> </P> Tue, 15 Jan 2019 18:03:04 GMT https://community.splunk.com/t5/Splunk-Search/eval-alerting-on-matching-fields/m-p/399393#M115809 sbattista09 2019-01-15T18:03:04Z https://community.splunk.com/t5/Splunk-Search/eval-alerting-on-matching-fields/m-p/399394#M115810 <P>the if statement will return 1 if the fields match else it will return 0</P> <P>| eval match=if(field1_foo==field2_foo,1,0)<BR /> | where match=1</P> <P>If you want to set an alert - save the search where 'match=1' (to get events where the fields are same) as an alert where you can schedule it to run periodically or create a correlation search in Splunk ES to create a notable event.</P> Tue, 29 Sep 2020 22:43:03 GMT https://community.splunk.com/t5/Splunk-Search/eval-alerting-on-matching-fields/m-p/399394#M115810 saurabhkharkar 2020-09-29T22:43:03Z