Splunk Search

Field Comparison Not Working in Basic Search

georgiawebber
Engager

I have two queries:

index=main
| eval var1="avalue"
| eval var2="avalue"
| search var1=var2

and

index=main
| eval var1="avalue"
| eval var2="avalue"
| search var1="avalue"

How is it that the second query returns events, whereas the the first returns none? I would think they are essentially doing the same string comparison on the final line?

Any help would be great 🙂

Tags (1)
0 Karma
1 Solution

MuS
Legend

Hi georgiawebber,

the second search is searching for the string avalue and returns events that contain the field var1 = "avalue".
the first search should be a where if you want to compare the values of two fields. So like :

 | where var1 = var2 

Hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi georgiawebber,

the second search is searching for the string avalue and returns events that contain the field var1 = "avalue".
the first search should be a where if you want to compare the values of two fields. So like :

 | where var1 = var2 

Hope this helps ...

cheers, MuS

georgiawebber
Engager

Thanks MuS. I understand that typically 'where' should be used, however am more curious as to why the case I presented does not work. Possibly it is just one of Splunk's many quirks...

0 Karma

MuS
Legend

Exactly for the reasons I told you search will search in the _raw for a string, while where uses eval to compare two values of two fields 😉

0 Karma

georgiawebber
Engager

Aye I understand you now - that makes sense. Thanks!

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...