I want to match one field value with other field values. If Value in btc field is present in NEB_Sales_Oppy_Business_Type I should get True otherwise False. I tried with the following query:
| eval Is_businees_type_matching=if(match(NEB_Sales_Oppy_Business_Type, btc), "TRUE", "FALSE")
Why I am getting False for 3 rows even the value is available in both fields.
The problems is that the match string is a regex, so if btc would need to be
New Equipment \(NEB\)
for the match to work. See this example
| makeresults
| fields - _time
| eval NEB_Sales_Oppy_Business_Type="New Equipment (NEB)|Modernization (FRB)|Modernization (TRB)", btc="New Equipment (NEB)", btc1="New Equipment \(NEB\)"
| eval Is_businees_type_matching=if(match(NEB_Sales_Oppy_Business_Type, btc), "TRUE", "FALSE")
| eval Is_businees_type_matching1=if(match(NEB_Sales_Oppy_Business_Type, btc1), "TRUE", "FALSE")
@bowesmana, thanks for your response its working now as per my requirement.
Try replacing the open and close brackets in the btc field
| eval Is_business_type_matching=if(match(NEB_Sales_Oppy_Business_Type, replace(replace(btc,"\)","\)"),"\(","\(")), "TRUE", "FALSE")
Hi @ITWhisperer , yes its also working thanks for the support and response.
Hi @punithsj96
can you swap the fields in match and try it?
| eval Is_businees_type_matching=if(match(btc,NEB_Sales_Oppy_Business_Type), "TRUE", "FALSE")
Hi @SanjayReddy
Thanks for your response, I tried still its not working.
The problems is that the match string is a regex, so if btc would need to be
New Equipment \(NEB\)
for the match to work. See this example
| makeresults
| fields - _time
| eval NEB_Sales_Oppy_Business_Type="New Equipment (NEB)|Modernization (FRB)|Modernization (TRB)", btc="New Equipment (NEB)", btc1="New Equipment \(NEB\)"
| eval Is_businees_type_matching=if(match(NEB_Sales_Oppy_Business_Type, btc), "TRUE", "FALSE")
| eval Is_businees_type_matching1=if(match(NEB_Sales_Oppy_Business_Type, btc1), "TRUE", "FALSE")