How do I reference other fields in a Splunk regex search?

[jonbelanger]

Would like to do this:

Where indexa has two fields, md5 and allmd5

Two records exist like this:

md5=99ed710da1d10b1cf8c4fb7c2549a9dc
allmd5={"MD5":"99ed710da1d10b1cf8c4fb7c2549a9dc". MD5:"6ac349a75ff9e7cbc92cd68c5fc44eed", "MD5":"8ca9e5e0a7cdb058f6f33f60a2fde2ef"}

md5=45c4a725006767124e21242670e7795f 
allmd5={"MD5":"99ed710da1d10b1cf8c4fb7c2549a9dc". MD5:"6ac349a75ff9e7cbc92cd68c5fc44eed", "MD5":"8ca9e5e0a7cdb058f6f33f60a2fde2ef"}

I've tried:

index=indexa | regex allmd5!=md5

and

index=indexa | regex allmd5!="\"".md5."\""

Tried it with eval too

but it always returns all records where it should just return the case where the value of md5 for that record is NOT in the allmd5 value.

What am I missing?

[gokadroid · Accepted solution]

Can you try this simply:

yourBaseSearch to return md5 and allmd5
| eval matched=if(match(allmd5, md5), 1, 0)
| table md5, allmd5, matched
| where matched=0

[jonbelanger]

worked perfectly, thank you!

[bshuler_splunk]

| makeresults | eval data="md5=99ed710da1d10b1cf8c4fb7c2549a9dc#allmd5={\"MD5\":\"99ed710da1d10b1cf8c4fb7c2549a9dc\". MD5:\"6ac349a75ff9e7cbc92cd68c5fc44eed\", \"MD5\":\"8ca9e5e0a7cdb058f6f33f60a2fde2ef\"}%md5=45c4a725006767124e21242670e7795f#allmd5={\"MD5\":\"99ed710da1d10b1cf8c4fb7c2549a9dc\". MD5:\"6ac349a75ff9e7cbc92cd68c5fc44eed\", \"MD5\":\"8ca9e5e0a7cdb058f6f33f60a2fde2ef\"}\"" | rex max_match=0 field=data "(?<line>[^%]+)" | mvexpand line |  rex  field=line "md5=(?<md5>[^#]+)#allmd5=(?<allmd5>[^#]+)" | table md5 allmd5 | where NOT match(allmd5, md5)