Hello, I have the splunk query below which has multiple sourcetype rows and if the row has x-correlation-id keywpord matching it needs to return Status x-correlation-id (or) return missing otherwise, there are couple of rows which has x-correlation-id in header and all rows are currently returning as "missing" , any ideas why the match is not working ?
environment=prod sourcetype=* "x-correlation-id" | fields sourcetype, Properties.Headers{} , Properties.CorrelationId, CorrelationId, Category | eval Status=if(match("Properties.Headers{}", "X-Correlation-id"),"x-correlation-id", "missing") | dedup sourcetype | table sourcetype,Status, Properties.CorrelationId, CorrelationId, Category | sort str(Properties.Headers{})
sourcetype status Properties.CorrelationId
o1 missing c1
o2 missing c2
o3 missing c3
o4 missing c4
o5 missing c5
o6 missing c6
o7 missing c7
08 missing c8
environment=prod sourcetype=* "x-correlation-id"
| fields sourcetype, Properties.Headers{} , Properties.CorrelationId, CorrelationId, Category
| rename Properties.Headers{} as Properties_Headers , Properties.CorrelationId as Properties_CorrelationId
| stats latest(*) as * by sourcetype
| eval Status=if(match(Properties_Headers, "(?i)X-Correlation-id"),"x-correlation-id", "missing")
| sort str(Properties_Headers)
| table sourcetype, Status, Properties_CorrelationId, CorrelationId, Category
match()
use REGEX , this is case-sensitive.