Getting Data In

Why "match" condition is not working?

punithsj96
Explorer

I want to match one field value with other field values. If Value in btc field is present in NEB_Sales_Oppy_Business_Type I should get True otherwise False. I tried with the following query:

| eval Is_businees_type_matching=if(match(NEB_Sales_Oppy_Business_Type, btc), "TRUE", "FALSE")

Why I am getting False for 3 rows even the value is available in both fields.

splunk_doubt.PNG

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

The problems is that the match string is a regex, so if btc would need to be

New Equipment \(NEB\)

for the match to work. See this example

| makeresults
| fields - _time
| eval NEB_Sales_Oppy_Business_Type="New Equipment (NEB)|Modernization (FRB)|Modernization (TRB)", btc="New Equipment (NEB)", btc1="New Equipment \(NEB\)"
| eval Is_businees_type_matching=if(match(NEB_Sales_Oppy_Business_Type, btc), "TRUE", "FALSE")
| eval Is_businees_type_matching1=if(match(NEB_Sales_Oppy_Business_Type, btc1), "TRUE", "FALSE")

View solution in original post

punithsj96
Explorer

@bowesmana, thanks for your response its working now as per my requirement.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try replacing the open and close brackets in the btc field

| eval Is_business_type_matching=if(match(NEB_Sales_Oppy_Business_Type, replace(replace(btc,"\)","\)"),"\(","\(")), "TRUE", "FALSE")

punithsj96
Explorer

Hi @ITWhisperer , yes its also working thanks for the support and response.

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

Hi @punithsj96

can you swap the fields in match and try it?

| eval Is_businees_type_matching=if(match(btc,NEB_Sales_Oppy_Business_Type), "TRUE", "FALSE")

0 Karma

punithsj96
Explorer

Hi @SanjayReddy

Thanks for your response, I tried still its not working.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

The problems is that the match string is a regex, so if btc would need to be

New Equipment \(NEB\)

for the match to work. See this example

| makeresults
| fields - _time
| eval NEB_Sales_Oppy_Business_Type="New Equipment (NEB)|Modernization (FRB)|Modernization (TRB)", btc="New Equipment (NEB)", btc1="New Equipment \(NEB\)"
| eval Is_businees_type_matching=if(match(NEB_Sales_Oppy_Business_Type, btc), "TRUE", "FALSE")
| eval Is_businees_type_matching1=if(match(NEB_Sales_Oppy_Business_Type, btc1), "TRUE", "FALSE")

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...