Splunk Enterprise Security

Correct way to use NOT match

Path Finder

Hi,

Whats the correct syntax to use when trying to return results where two fields DO NOT match?

Trying the following, but not within any great success;

| where NOT match(field A, field B)

Thanks.

0 Karma
1 Solution

Builder

There are lots of ways to solve this. I might go with something like:

| makeresults 
| eval fieldA="12345" 
| eval fieldB="1234" 
| eval DoTheyMatch=case(
    fieldA = fieldB,"TheyMatch",
    1==1, "TheyDoNotMatch"
    ) 
| where DoTheyMatch="TheyDoNotMatch"

To go to the docs, be aware of the following background information:
https://docs.splunk.com/Documentation/Splunk/Latest/Search/NOTexpressions
https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/ConditionalFunctions

###

If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Path Finder

| makeresults
| eval fieldA=123, fieldB=321
| where fieldA!=fieldB

0 Karma

Builder

There are lots of ways to solve this. I might go with something like:

| makeresults 
| eval fieldA="12345" 
| eval fieldB="1234" 
| eval DoTheyMatch=case(
    fieldA = fieldB,"TheyMatch",
    1==1, "TheyDoNotMatch"
    ) 
| where DoTheyMatch="TheyDoNotMatch"

To go to the docs, be aware of the following background information:
https://docs.splunk.com/Documentation/Splunk/Latest/Search/NOTexpressions
https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/ConditionalFunctions

###

If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

as mentioned many ways

 | makeresults 
 | eval fieldA="12345" 
 | eval fieldB="1234"
 | where !like(fieldA,fieldB)
0 Karma

Path Finder

Thanks all. Was overthinking things.

0 Karma

SplunkTrust
SplunkTrust

| where A!=B