Splunk Search

Comparing fields that don't match.

howyagoin
Contributor

Hi,

I've been trying to solve this one with various hints given here already (subsearch, use of eval, etc), but haven't found an approach that works...

I have a list of email addresses, as well as the first name and last name of the account owner.

I'm trying to build up a list of events/entries where neither the first nor the last name appears anywhere obvious in the email address itself.

By using eval, it was easy enough to split the email account name from the domain, but, what's the best way to find the following:

First  Last      Email
----------------------------------------
Tom     Smith     tsmith@foo.com
Jane    Doe       yellowpony@blerp.edu
Bob     Jones     bobjo@morp.com

What I'd like to do is have only Jane Doe show up in a query, as only her address contains neither her first name or last name.

Thanks for any suggestions!

Tags (2)
0 Karma
1 Solution

Ayn
Legend

Use where and match the first and last name with the email address.

... | where !(match(lower(Email),lower(First)) OR match(lower(Email),lower(Last)))

View solution in original post

0 Karma

Ayn
Legend

Use where and match the first and last name with the email address.

... | where !(match(lower(Email),lower(First)) OR match(lower(Email),lower(Last)))
0 Karma

howyagoin
Contributor

D'OH, I had tried match, but didn't think about the lower() first. Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...