Comparing fields that don't match.

[howyagoin]

Hi,

I've been trying to solve this one with various hints given here already (subsearch, use of eval, etc), but haven't found an approach that works...

I have a list of email addresses, as well as the first name and last name of the account owner.

I'm trying to build up a list of events/entries where neither the first nor the last name appears anywhere obvious in the email address itself.

By using eval, it was easy enough to split the email account name from the domain, but, what's the best way to find the following:

First  Last      Email
----------------------------------------
Tom     Smith     tsmith@foo.com
Jane    Doe       yellowpony@blerp.edu
Bob     Jones     bobjo@morp.com

What I'd like to do is have only Jane Doe show up in a query, as only her address contains neither her first name or last name.

Thanks for any suggestions!

[Ayn · Accepted solution]

Use where and match the first and last name with the email address.

... | where !(match(lower(Email),lower(First)) OR match(lower(Email),lower(Last)))

[howyagoin]

D'OH, I had tried match, but didn't think about the lower() first. Thanks!