https://community.splunk.com/t5/Splunk-Search/Comparing-2-fields/m-p/91960#M182341 <P>Hello</P> <P>Probably you need to remove the domain part from the referrer field, as the uri doesn't include that part. Lets say:<BR /> uri: /example/page.html<BR /> referrer: <A href="http://www.example.com/example/page.html">http://www.example.com/example/page.html</A></P> <P>Regards</P> Mon, 14 Oct 2013 11:18:35 GMT gfuente 2013-10-14T11:18:35Z https://community.splunk.com/t5/Splunk-Search/Comparing-2-fields/m-p/91953#M182334 <P>Hi, </P> <P>I have 2 fields that are already extracted uri and referer. I want to right a search based on if <BR /> uri value =referer value. I guess i have to use eval. Can you please give me syntax?</P> Thu, 10 Oct 2013 04:11:07 GMT https://community.splunk.com/t5/Splunk-Search/Comparing-2-fields/m-p/91953#M182334 xvxt006 2013-10-10T04:11:07Z https://community.splunk.com/t5/Splunk-Search/Comparing-2-fields/m-p/91954#M182335 <PRE><CODE>| eval yourfield=if(uri==referer,... </CODE></PRE> Thu, 10 Oct 2013 06:28:15 GMT https://community.splunk.com/t5/Splunk-Search/Comparing-2-fields/m-p/91954#M182335 Ayn 2013-10-10T06:28:15Z https://community.splunk.com/t5/Splunk-Search/Comparing-2-fields/m-p/91955#M182336 <P>Is that correct? Normally <CODE>eval</CODE> is an assignment of a value to a field.</P> Thu, 10 Oct 2013 08:43:37 GMT https://community.splunk.com/t5/Splunk-Search/Comparing-2-fields/m-p/91955#M182336 kristian_kolb 2013-10-10T08:43:37Z https://community.splunk.com/t5/Splunk-Search/Comparing-2-fields/m-p/91956#M182337 <PRE><CODE>... | where uri==referer | ... </CODE></PRE> <P>/K</P> Thu, 10 Oct 2013 08:44:11 GMT https://community.splunk.com/t5/Splunk-Search/Comparing-2-fields/m-p/91956#M182337 kristian_kolb 2013-10-10T08:44:11Z https://community.splunk.com/t5/Splunk-Search/Comparing-2-fields/m-p/91957#M182338 <P>Oh! No, very much incorrect. Early morning - correcting.</P> Thu, 10 Oct 2013 09:19:23 GMT https://community.splunk.com/t5/Splunk-Search/Comparing-2-fields/m-p/91957#M182338 Ayn 2013-10-10T09:19:23Z https://community.splunk.com/t5/Splunk-Search/Comparing-2-fields/m-p/91958#M182339 <P>Actually i tried this but did not work. i am getting no results.</P> Mon, 14 Oct 2013 01:17:16 GMT https://community.splunk.com/t5/Splunk-Search/Comparing-2-fields/m-p/91958#M182339 xvxt006 2013-10-14T01:17:16Z https://community.splunk.com/t5/Splunk-Search/Comparing-2-fields/m-p/91959#M182340 <P>That happens if uri is never equal to referer. Check your fields.</P> Mon, 14 Oct 2013 06:20:42 GMT https://community.splunk.com/t5/Splunk-Search/Comparing-2-fields/m-p/91959#M182340 Ayn 2013-10-14T06:20:42Z https://community.splunk.com/t5/Splunk-Search/Comparing-2-fields/m-p/91960#M182341 <P>Hello</P> <P>Probably you need to remove the domain part from the referrer field, as the uri doesn't include that part. Lets say:<BR /> uri: /example/page.html<BR /> referrer: <A href="http://www.example.com/example/page.html">http://www.example.com/example/page.html</A></P> <P>Regards</P> Mon, 14 Oct 2013 11:18:35 GMT https://community.splunk.com/t5/Splunk-Search/Comparing-2-fields/m-p/91960#M182341 gfuente 2013-10-14T11:18:35Z