topic Re: comparing two string doesn't work in Splunk Search

comparing two string doesn't work

rezaeimo — Thu, 13 Jul 2023 01:42:26 GMT

i have a search query and i want to add another condition to check the url if test!=staging. the first test is coming as a parameter and could be test, staging or prod. i've done following query but test!=staging part doesn't work and not returning as true.

index="my_index" AND (test!=staging OR "Properties.URL"="*stg*") source=Payments

Re: comparing two string doesn't work

gcusello — Thu, 13 Jul 2023 06:22:18 GMT

Hi @rezaeimo,

you could try using quotes for the staging value:

index="my_index" (test!="staging" OR "Properties.URL"="*stg*") source=Payments

or you could try the other conditions: it's alwayes beter to use positive condition than negative ones:

index="my_index" (test IN ("test","prod") OR "Properties.URL"="*stg*") source=Payments

Ciao.

Giuseppe

Re: comparing two string doesn't work

rezaeimo — Fri, 14 Jul 2023 04:14:16 GMT

for me the fix was to use where keyword.

index="my_index" source=Payments |search ("test" !="staging" OR "Properties.URL"="*stg*")

Re: comparing two string doesn't work

gcusello — Fri, 14 Jul 2023 06:32:44 GMT

Hi @rezaeimo,

you don't need to use the search command after the main search, this ommand is used only if you have to use a field not defined in the main search.

in addition you don't need to use quotes for fields without spaces or special chars.

Ciao,.

Giuseppe

Re: comparing two string doesn't work

rezaeimo — Sun, 16 Jul 2023 23:40:37 GMT

i've used where key word like the following. now the first condition works but the second condition doesn't work. name is a parameter that could be test, staging or prod. do you have any idea why the second condition doesn't work?

index="my_index" source=Payments |where ("#{name}"!="staging" OR "Properties.URL" like "%stg%")

Re: comparing two string doesn't work

gcusello — Mon, 17 Jul 2023 06:01:46 GMT

Hi @rezaeimo ,

I'm not sure about the conditions you used and sometimes the dot in the field name gives problems, so please try this:

index="my_index" source=Payments | rename Properties.URL AS URL | search ("test"!="staging" OR URL like "%stg%")

Ciao.

Giuseppe

Re: comparing two string doesn't work

PickleRick — Mon, 17 Jul 2023 06:21:41 GMT

You're comparing two strings which will never match.

You need to use single quotes for the field name

'Properties.URL' like "%stg%"

Re: comparing two string doesn't work

rezaeimo — Mon, 17 Jul 2023 06:29:54 GMT

great idea to use rename, thanks for that. . didn't worked with search but i've used rename and where and it got it working. here is what worked for me.

index="my_index" source=Payments |rename "Properties.URL" as Url |where ("#{name}"!="staging" OR Url like "%stg%")

Re: comparing two string doesn't work

gcusello — Mon, 17 Jul 2023 07:18:04 GMT

Hi @rezaeimo,

as I said, this is a frequent issue that I don't understand why someone in Splunk doesn't resolve!

Anyway,

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

Re: comparing two string doesn't work

PickleRick — Mon, 17 Jul 2023 07:32:55 GMT

That's not a real issue. If you have field names consisting of more than just alphanumeric characters, you use single quotes to define them. In fact you can use the single quotes every time, it's just that with "simple" field names you can omit them.