topic Re: How to create an eval column in a table that says &quot;match&quot; or &quot;no match&quot; if the value of all columns is the same/or not for each row? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-create-an-eval-column-in-a-table-that-says-quot-match/m-p/399857#M115892 <P>@samiksha86, based on the sample data provided try the following run anywhere search. Command from <CODE>makeresults</CODE> till <CODE>| table test host1 host2 host3</CODE> generates the sample data as per the question.</P> <PRE><CODE>| makeresults | eval data="test1 x1 x1 x1;test2 y1 y2 y1;test3 z1 z2 z3" | makemv data delim=";" | mvexpand data | makemv data delim=" " | eval test=mvindex(data,0),host1=mvindex(data,1),host2=mvindex(data,2),host3=mvindex(data,3) | table test host1 host2 host3 | eval temp=host1.",".host2.",".host3 | makemv temp delim="," | eval temp=mvdedup(temp), matchCount=mvcount(temp), temp=if(matchCount=1,"Matched","Not Matched") </CODE></PRE> Wed, 16 May 2018 10:20:46 GMT niketn 2018-05-16T10:20:46Z How to create an eval column in a table that says "match" or "no match" if the value of all columns is the same/or not for each row? https://community.splunk.com/t5/Splunk-Search/How-to-create-an-eval-column-in-a-table-that-says-quot-match/m-p/399856#M115891 <PRE><CODE>test host1 host2 host3 temp test1 x1 x1 x1 Match test2 y1 y2 y1 No match test3 z1 z1 z3 No match </CODE></PRE> Wed, 16 May 2018 06:39:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-eval-column-in-a-table-that-says-quot-match/m-p/399856#M115891 samiksha86 2018-05-16T06:39:34Z Re: How to create an eval column in a table that says "match" or "no match" if the value of all columns is the same/or not for each row? https://community.splunk.com/t5/Splunk-Search/How-to-create-an-eval-column-in-a-table-that-says-quot-match/m-p/399857#M115892 <P>@samiksha86, based on the sample data provided try the following run anywhere search. Command from <CODE>makeresults</CODE> till <CODE>| table test host1 host2 host3</CODE> generates the sample data as per the question.</P> <PRE><CODE>| makeresults | eval data="test1 x1 x1 x1;test2 y1 y2 y1;test3 z1 z2 z3" | makemv data delim=";" | mvexpand data | makemv data delim=" " | eval test=mvindex(data,0),host1=mvindex(data,1),host2=mvindex(data,2),host3=mvindex(data,3) | table test host1 host2 host3 | eval temp=host1.",".host2.",".host3 | makemv temp delim="," | eval temp=mvdedup(temp), matchCount=mvcount(temp), temp=if(matchCount=1,"Matched","Not Matched") </CODE></PRE> Wed, 16 May 2018 10:20:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-eval-column-in-a-table-that-says-quot-match/m-p/399857#M115892 niketn 2018-05-16T10:20:46Z Re: How to create an eval column in a table that says "match" or "no match" if the value of all columns is the same/or not for each row? https://community.splunk.com/t5/Splunk-Search/How-to-create-an-eval-column-in-a-table-that-says-quot-match/m-p/399858#M115893 <P>@niketnilay, what if the the values i.e. x1,x2y1,z1,etc are subject to changes and we have to compare then.<BR /> How to compare in that scenario?</P> Thu, 26 Jul 2018 07:14:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-eval-column-in-a-table-that-says-quot-match/m-p/399858#M115893 abhi04 2018-07-26T07:14:18Z