https://community.splunk.com/t5/Splunk-Search/Eval-check-condition-not-working/m-p/471898#M132769 <P>Hello, I have the splunk query below which has multiple sourcetype rows and if the row has x-correlation-id keywpord matching it needs to return Status x-correlation-id (or) return missing otherwise, there are couple of rows which has x-correlation-id in header and all rows are currently returning as "missing" , any ideas why the match is not working ?</P> <P>environment=prod sourcetype=* "x-correlation-id" | fields sourcetype, Properties.Headers{} , Properties.CorrelationId, CorrelationId, Category | eval Status=if(match("Properties.Headers{}", "X-Correlation-id"),"x-correlation-id", "missing") | dedup sourcetype | table sourcetype,Status, Properties.CorrelationId, CorrelationId, Category | sort str(Properties.Headers{})</P> <P>sourcetype status Properties.CorrelationId<BR /><BR /> o1 missing c1<BR /><BR /> o2 missing c2<BR /><BR /> o3 missing c3<BR /><BR /> o4 missing c4<BR /><BR /> o5 missing c5<BR /> o6 missing c6<BR /><BR /> o7 missing c7<BR /><BR /> 08 missing c8 </P> Mon, 13 Apr 2020 20:34:12 GMT msrama5 2020-04-13T20:34:12Z https://community.splunk.com/t5/Splunk-Search/Eval-check-condition-not-working/m-p/471898#M132769 <P>Hello, I have the splunk query below which has multiple sourcetype rows and if the row has x-correlation-id keywpord matching it needs to return Status x-correlation-id (or) return missing otherwise, there are couple of rows which has x-correlation-id in header and all rows are currently returning as "missing" , any ideas why the match is not working ?</P> <P>environment=prod sourcetype=* "x-correlation-id" | fields sourcetype, Properties.Headers{} , Properties.CorrelationId, CorrelationId, Category | eval Status=if(match("Properties.Headers{}", "X-Correlation-id"),"x-correlation-id", "missing") | dedup sourcetype | table sourcetype,Status, Properties.CorrelationId, CorrelationId, Category | sort str(Properties.Headers{})</P> <P>sourcetype status Properties.CorrelationId<BR /><BR /> o1 missing c1<BR /><BR /> o2 missing c2<BR /><BR /> o3 missing c3<BR /><BR /> o4 missing c4<BR /><BR /> o5 missing c5<BR /> o6 missing c6<BR /><BR /> o7 missing c7<BR /><BR /> 08 missing c8 </P> Mon, 13 Apr 2020 20:34:12 GMT https://community.splunk.com/t5/Splunk-Search/Eval-check-condition-not-working/m-p/471898#M132769 msrama5 2020-04-13T20:34:12Z https://community.splunk.com/t5/Splunk-Search/Eval-check-condition-not-working/m-p/471899#M132770 <PRE><CODE>environment=prod sourcetype=* "x-correlation-id" | fields sourcetype, Properties.Headers{} , Properties.CorrelationId, CorrelationId, Category | rename Properties.Headers{} as Properties_Headers , Properties.CorrelationId as Properties_CorrelationId | stats latest(*) as * by sourcetype | eval Status=if(match(Properties_Headers, "(?i)X-Correlation-id"),"x-correlation-id", "missing") | sort str(Properties_Headers) | table sourcetype, Status, Properties_CorrelationId, CorrelationId, Category </CODE></PRE> <P><CODE>match()</CODE> use REGEX , this is case-sensitive.</P> Mon, 13 Apr 2020 23:25:25 GMT https://community.splunk.com/t5/Splunk-Search/Eval-check-condition-not-working/m-p/471899#M132770 to4kawa 2020-04-13T23:25:25Z