Correct way to use NOT match

[jacqu3sy]

Hi,

Whats the correct syntax to use when trying to return results where two fields DO NOT match?

Trying the following, but not within any great success;

| where NOT match(field A, field B)

Thanks.

[joshex]

| where !(fieldname like "keyword%")

[acfecondo75]

| makeresults
| eval fieldA=123, fieldB=321
| where fieldA!=fieldB

[efavreau · Accepted solution]

There are lots of ways to solve this. I might go with something like:

| makeresults 
| eval fieldA="12345" 
| eval fieldB="1234" 
| eval DoTheyMatch=case(
    fieldA = fieldB,"TheyMatch",
    1==1, "TheyDoNotMatch"
    ) 
| where DoTheyMatch="TheyDoNotMatch"

To go to the docs, be aware of the following background information:
https://docs.splunk.com/Documentation/Splunk/Latest/Search/NOTexpressions
https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/ConditionalFunctions

[starcher]

as mentioned many ways

 | makeresults 
 | eval fieldA="12345" 
 | eval fieldB="1234"
 | where !like(fieldA,fieldB)

[jacqu3sy]

Thanks all. Was overthinking things.

[adonio]

| where A!=B