https://community.splunk.com/t5/Splunk-Search/Eval-variable1-variable2-is-True-or-False/m-p/81604#M20704 <P>Folks... I am extracting two variables at search time and trying to report when the two variables are not the same. At this point the two variables are host (coming from the splunk LF running on the system) and os_hostname (coming from a script that calls hostname on a linux box). Basically I want to know when host!=os_hostname and report on that. We have some admins that are cloning servers and forgetting to re-install Splunk so all the cloned systems are reporting as if they were the original cloned system.</P> <P>I assume there is a way to do this with the Eval command, but can't seem to find the right syntax. Can someone help me?</P> Tue, 02 Nov 2010 00:58:27 GMT starks951 2010-11-02T00:58:27Z https://community.splunk.com/t5/Splunk-Search/Eval-variable1-variable2-is-True-or-False/m-p/81604#M20704 <P>Folks... I am extracting two variables at search time and trying to report when the two variables are not the same. At this point the two variables are host (coming from the splunk LF running on the system) and os_hostname (coming from a script that calls hostname on a linux box). Basically I want to know when host!=os_hostname and report on that. We have some admins that are cloning servers and forgetting to re-install Splunk so all the cloned systems are reporting as if they were the original cloned system.</P> <P>I assume there is a way to do this with the Eval command, but can't seem to find the right syntax. Can someone help me?</P> Tue, 02 Nov 2010 00:58:27 GMT https://community.splunk.com/t5/Splunk-Search/Eval-variable1-variable2-is-True-or-False/m-p/81604#M20704 starks951 2010-11-02T00:58:27Z https://community.splunk.com/t5/Splunk-Search/Eval-variable1-variable2-is-True-or-False/m-p/81605#M20705 <PRE><CODE>... | eval state=if(host!=os_hostname,"bad","good") </CODE></PRE> Tue, 02 Nov 2010 01:01:14 GMT https://community.splunk.com/t5/Splunk-Search/Eval-variable1-variable2-is-True-or-False/m-p/81605#M20705 gkanapathy 2010-11-02T01:01:14Z https://community.splunk.com/t5/Splunk-Search/Eval-variable1-variable2-is-True-or-False/m-p/81606#M20706 <P>This works GREAT... any way to make it more fuzzy so it doesn't care about capital letters, IE host=computera and os_hostname=COMPUTERA ?</P> Tue, 02 Nov 2010 03:30:17 GMT https://community.splunk.com/t5/Splunk-Search/Eval-variable1-variable2-is-True-or-False/m-p/81606#M20706 starks951 2010-11-02T03:30:17Z https://community.splunk.com/t5/Splunk-Search/Eval-variable1-variable2-is-True-or-False/m-p/81607#M20707 <P><CODE>if(lower(host)!=lower(os_hostname),...)</CODE></P> Tue, 02 Nov 2010 13:15:42 GMT https://community.splunk.com/t5/Splunk-Search/Eval-variable1-variable2-is-True-or-False/m-p/81607#M20707 gkanapathy 2010-11-02T13:15:42Z https://community.splunk.com/t5/Splunk-Search/Eval-variable1-variable2-is-True-or-False/m-p/81608#M20708 <P>If you really just want to know when host!=os_hostname, just use</P> <PRE><CODE> ... | where host!=os_hostname </CODE></PRE> Tue, 11 Jan 2011 02:43:04 GMT https://community.splunk.com/t5/Splunk-Search/Eval-variable1-variable2-is-True-or-False/m-p/81608#M20708 carasso 2011-01-11T02:43:04Z