topic Re: Matching showing incorrect values in Splunk Search

Matching showing incorrect values

RobertEttinger8 — Sun, 06 Oct 2019 11:48:59 GMT

Hi guys & girls,

about the following query:

...Why are the results different? It's almost like the MATCH command is adding a hidden .* at the end of the string ... If so, how to fix this?

Thank you,
Robert

Re: Matching showing incorrect values

richgalloway — Sun, 06 Oct 2019 12:38:19 GMT

The match function expects a regular expression as its second argument. Every regex has an implicit .* at each end unless an anchor is used. That means the match in your sample code will match any expectedm that contains the digit '1'. To look for exactly "1", use expectedM=^1$.

Re: Matching showing incorrect values

RobertEttinger8 — Mon, 07 Oct 2019 08:05:20 GMT

Thank you for the explanation, but ... I am comparing two fields, so I cannot add the regex ^ and $ parameters to the match command, or can I?

Re: Matching showing incorrect values

richgalloway — Mon, 07 Oct 2019 10:43:58 GMT

You can use a temporary field for the comparison.

| makeresults
| eval expectedm="10"
| eval expectedM="1"
| eval matchField="^".expectedM."$"
| eval match=case(match(expectedm, matchField), "Yes", true(), "No")
| eval match1=if(expectedm=expectedM, "Yes", "No")