topic Re: Searchmatch not returning expected result in Splunk Search

Searchmatch not returning expected result

chca — Mon, 28 Sep 2020 09:46:52 GMT

search * | eval userAgentType=if(searchmatch("cs_User_Agent_=*MSIE*"), "Internet Explorer", "Other") | search userAgentType="Other" cs_User_Agent_=*MSIE*

Based upon that search, there should be no results. The eval should assign all cs_User_Agent_ fields that do not contain "MSIE" to "Other", and then the following search should only display results that are of type "Other" and include "MSIE." However, that is not the case--several results display. Any idea why?

Here's an example of the data:



Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.0;+WOW64;+GTB6.6;+SLCC1;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506;+Media+Center+PC+5.0)

UPDATE

I've discovered that including the field in the searchmatch call is causing the false negatives. Can you not specify a field name as part of the searchmatch parameter?
Works:

searchmatch("*MSIE*")

Doesn't work:



searchmatch("cs_User_Agent_=MSIE")

Re: Searchmatch not returning expected result

gkanapathy — Fri, 05 Aug 2011 03:58:27 GMT

Try either

searchmatch("cs_User_Agent=\"*MSIE*\"")

if this is in the GUI, or whatever you need to do to include double-quotes in your search string if not in the GUI.

Or, you can try:

match(cs_User_Agent,"MSIE")

Which is probably more efficient anyway.

Re: Searchmatch not returning expected result

chca — Fri, 05 Aug 2011 14:30:47 GMT

Converting to the regex method works great. Thanks!