Splunk Search

Matching showing incorrect values

RobertEttinger8
Loves-to-Learn Lots

Hi guys & girls,

about the following query:

| makeresults
| eval expectedm="10"
| eval expectedM="1"
| eval match=case(match(expectedm, expectedM), "Yes", true(), "No")
| eval match1=if(expectedm=expectedM, "Yes", "No")

...Why are the results different? It's almost like the MATCH command is adding a hidden .* at the end of the string ... If so, how to fix this?

Thank you,
Robert

Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The match function expects a regular expression as its second argument. Every regex has an implicit .* at each end unless an anchor is used. That means the match in your sample code will match any expectedm that contains the digit '1'. To look for exactly "1", use expectedM=^1$.

---
If this reply helps you, Karma would be appreciated.
0 Karma

RobertEttinger8
Loves-to-Learn Lots

Thank you for the explanation, but ... I am comparing two fields, so I cannot add the regex ^ and $ parameters to the match command, or can I?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can use a temporary field for the comparison.

| makeresults
| eval expectedm="10"
| eval expectedM="1"
| eval matchField="^".expectedM."$"
| eval match=case(match(expectedm, matchField), "Yes", true(), "No")
| eval match1=if(expectedm=expectedM, "Yes", "No")
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Hi Splunky people! We are excited to share the newest updates in Splunk Enterprise 9.3!Admins and Analyst can ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...