topic Re: match function is not working in Splunk Search

match function is not working

Allampally — Fri, 17 Apr 2020 04:34:55 GMT

I have two fields called field1, field2. Both are having same value as "xyz" but when i try to compare them with match function, it is saying that both values are different. Output of below query is "No" but I am expecting the answer "Yes" as both are equal.
eval results1=if(field1=field2,"Yes","No")
If any field format make differ here ?

Re: match function is not working

renjith_nair — Fri, 17 Apr 2020 05:07:03 GMT

@Allampally ,
Try comparing it against the literal string. Probably a space or special characters might be the reason.

For .e.g try field1="xyz" and field2="xyz" separately and see if you are getting the expected result.

Re: match function is not working

Allampally — Fri, 17 Apr 2020 06:15:01 GMT

That way, it is working but i have extracted one field using rex. Not sure that is causing any difference.

Re: match function is not working

harishalipaka — Fri, 17 Apr 2020 06:27:09 GMT

hi @Allampally

try below --

|eval results1=if(match(field1,field2),"Yes","No")

|eval results1=if(like(field1,field2),"Yes","No")

|eval results1=if(field1==field2,"Yes","No")

If you not get results using this.check your fields contains any spaces.

|eval field1=upper(trim(fied1)),field2=trim(upper(field2))