Comparing fields that don't match.

howyagoin — Thu, 08 Dec 2011 07:33:43 GMT

Hi,

I've been trying to solve this one with various hints given here already (subsearch, use of eval, etc), but haven't found an approach that works...

I have a list of email addresses, as well as the first name and last name of the account owner.

I'm trying to build up a list of events/entries where neither the first nor the last name appears anywhere obvious in the email address itself.

By using eval, it was easy enough to split the email account name from the domain, but, what's the best way to find the following:

First  Last      Email
----------------------------------------
Tom     Smith     tsmith@foo.com
Jane    Doe       yellowpony@blerp.edu
Bob     Jones     bobjo@morp.com

What I'd like to do is have only Jane Doe show up in a query, as only her address contains neither her first name or last name.

Thanks for any suggestions!

Re: Comparing fields that don't match.

Ayn — Thu, 08 Dec 2011 07:57:09 GMT

Use where and match the first and last name with the email address.

... | where !(match(lower(Email),lower(First)) OR match(lower(Email),lower(Last)))

Re: Comparing fields that don't match.

howyagoin — Thu, 08 Dec 2011 08:40:58 GMT

D'OH, I had tried match, but didn't think about the lower() first. Thanks!

topic Re: Comparing fields that don't match. in Splunk Search

Comparing fields that don't match.

Re: Comparing fields that don't match.

Re: Comparing fields that don't match.