topic Re: Eval Comparision shows no matches despite both fields having same values in Splunk Search

Eval Comparision shows no matches despite both fields having same values

neerajs_81 — Wed, 30 Mar 2022 06:08:42 GMT

Hi All,
I need to filter my search based on the condition if the values of 2 fields are equal or not. The 2 fields in question are actor.alernateID and src_user_email and both fields are visible in the same event.

For example: Raw data shows value of actor.alternateID is anand.pandey@company.com

Likewise, Raw data shows value or src_user_email is also same: anand.pandey@company.com

If i run the following search, the value of the field match comes out to be "No match" . Why is eval showing them to be not a match if both field values are the same ?

index=xxx sourcetype=xxxx .... | eval match=if(actor.alternateId=src_user_email,"Match","No Match")

Likewise, instead if i use the where condition instead of eval , this shows NO results to display; meaning even the where clause thinks both fields are different .

|where src_user_email = actor.alternateID

The same is happening for other email IDs and other fields even though their values are same.

What am i doing wrong here? How to compare fields then? Both are strings.

Re: Eval Comparision shows no matches despite both fields having same values

gcusello — Wed, 30 Mar 2022 06:38:31 GMT

Hi @neerajs_81,

I suppose that you already checked if there's a space at the beginning or the eand of both values.

Anyway, please rename the field with dot and try again:

index=xxx sourcetype=xxxx .... | rename actor.alternateId AS alternateId | eval match=if(alternateId=src_user_email,"Match","No Match")

sometimes dot gives problem in eval command.

Ciao.,

Giuseppe

Re: Eval Comparision shows no matches despite both fields having same values

neerajs_81 — Wed, 30 Mar 2022 06:56:38 GMT

Holly Molly 🙂 Just when i was going thru your other post , you replied to my question.
https://community.splunk.com/t5/Splunk-Search/comparing-fields-to-find-identical-values/m-p/533089

Thank you so much that worked. 😀

Now is the . dot in the field name an issue with |search and |where clause also ? Because i did try comparing using both search and where in additional to eval as you mentioned in the other post and both didn't work. Do i need to rename the field if comparing via |search and |where as well ?

Re: Eval Comparision shows no matches despite both fields having same values

gcusello — Wed, 30 Mar 2022 07:10:06 GMT

Hi @neerajs_81,

I'm not sure about all the situations where dot gives problem, I'm sure about eval!

But anyway, I always rename eventual fields with dot or parenthesis or spaces or other strange chars.

Ciao.

Giuseppe