Comparing 2 fields

[xvxt006]

Hi,

I have 2 fields that are already extracted uri and referer. I want to right a search based on if
uri value =referer value. I guess i have to use eval. Can you please give me syntax?

[kristian_kolb]

... | where uri==referer | ...

/K

[gfuente]

Hello

Probably you need to remove the domain part from the referrer field, as the uri doesn't include that part. Lets say:
uri: /example/page.html
referrer: http://www.example.com/example/page.html

Regards

[Ayn]

That happens if uri is never equal to referer. Check your fields.

[xvxt006]

Actually i tried this but did not work. i am getting no results.

[Ayn]

| eval yourfield=if(uri==referer,...

[Ayn]

Oh! No, very much incorrect. Early morning - correcting.

[kristian_kolb]

Is that correct? Normally eval is an assignment of a value to a field.