Archive

Searchmatch not returning expected result

Path Finder
search * | eval userAgentType=if(searchmatch("cs_User_Agent_=*MSIE*"), "Internet Explorer", "Other") | search userAgentType="Other" cs_User_Agent_=*MSIE*

Based upon that search, there should be no results. The eval should assign all cs_User_Agent_ fields that do not contain "MSIE" to "Other", and then the following search should only display results that are of type "Other" and include "MSIE." However, that is not the case--several results display. Any idea why?

Here's an example of the data:


Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.0;+WOW64;+GTB6.6;+SLCC1;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506;+Media+Center+PC+5.0)

UPDATE

I've discovered that including the field in the searchmatch call is causing the false negatives. Can you not specify a field name as part of the searchmatch parameter?
Works:

searchmatch("*MSIE*")

Doesn't work:


searchmatch("cs_User_Agent_=MSIE")

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

Try either

searchmatch("cs_User_Agent=\"*MSIE*\"")

if this is in the GUI, or whatever you need to do to include double-quotes in your search string if not in the GUI.

Or, you can try:

match(cs_User_Agent,"MSIE")

Which is probably more efficient anyway.

View solution in original post

Splunk Employee
Splunk Employee

Try either

searchmatch("cs_User_Agent=\"*MSIE*\"")

if this is in the GUI, or whatever you need to do to include double-quotes in your search string if not in the GUI.

Or, you can try:

match(cs_User_Agent,"MSIE")

Which is probably more efficient anyway.

View solution in original post

Path Finder

Converting to the regex method works great. Thanks!

0 Karma