topic Re: help on a text comparison fonction in Splunk Search

help on a text comparison fonction

jip31 — Thu, 26 Sep 2019 14:30:24 GMT

I need to compare two fields from the text characters of these two fields
So I need to do something like this
where toto <> tata
The problem I have is the text one field is never exactly the same than in other field
It means that either the fields are really different and in this case I want to display the events nor the fields are almost the same
For example, if I have in one field called "spring" and in the othe field "spring - winter" I want to consider that these fields are the same because there is spring in both
Is there a solution to do this please?

Re: help on a text comparison fonction

adonio — Thu, 26 Sep 2019 15:26:59 GMT

to be clear, do you wish to do text comparison to values or to fields?
can you share some sample data?

Re: help on a text comparison fonction

Anantha123 — Thu, 26 Sep 2019 17:03:13 GMT

If the values in fields are constant then you may use rex , extract the required values from fields and compare it .

Re: help on a text comparison fonction

wmyersas — Thu, 26 Sep 2019 18:57:33 GMT

You might try something like:

| eval toto=upper(toto)
| eval tata=upper(tata)
| where match(toto,'tata') OR match(tata,'toto')

This should do a match() compare between the value of toto and the value of tata (using tata as a regex), and vice versa

Feel free to extrapolate from there how you might like to go