topic Re: how to compare multiple fields in Splunk Search

how to compare multiple fields

Tridi123 — Fri, 12 Oct 2012 04:43:56 GMT

i have key words like project,plan ,lease
now if any file name if these key word hits i need to find which keywords have hitted.

if my file mane is Project_plan gamil.doc then keywords hitted are

project and plan.
Can anyone help what should be the Splunk query for this require ment

Re: how to compare multiple fields

yannK — Mon, 28 Sep 2020 12:37:13 GMT

After the search, use a regex extraction like rex or an eval function like match to check the presence of the keyword in the source field. And make correction for any case case sensitive matching.
Then you can have a field that will contain or not the matching.

example :



mysearch | rex field=source "(?(?i)(project))" | table _time found_project source _raw



mysearch | eval source_lowercase=lower(source) | eval found_project=match(source_lowercase,project) | table _time found_project source _raw

Re: how to compare multiple fields

Tridi123 — Mon, 15 Oct 2012 05:50:13 GMT

suppose my filed is like contain both plan and project and i want my found_project column as project,plan what should i do
and the second query is not working as macth returns boolean only can u help once againg for this isssue??