Splunk Search

Matching showing incorrect values

RobertEttinger8
Loves-to-Learn Lots

Hi guys & girls,

about the following query:

| makeresults
| eval expectedm="10"
| eval expectedM="1"
| eval match=case(match(expectedm, expectedM), "Yes", true(), "No")
| eval match1=if(expectedm=expectedM, "Yes", "No")

...Why are the results different? It's almost like the MATCH command is adding a hidden .* at the end of the string ... If so, how to fix this?

Thank you,
Robert

Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The match function expects a regular expression as its second argument. Every regex has an implicit .* at each end unless an anchor is used. That means the match in your sample code will match any expectedm that contains the digit '1'. To look for exactly "1", use expectedM=^1$.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

RobertEttinger8
Loves-to-Learn Lots

Thank you for the explanation, but ... I am comparing two fields, so I cannot add the regex ^ and $ parameters to the match command, or can I?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can use a temporary field for the comparison.

| makeresults
| eval expectedm="10"
| eval expectedM="1"
| eval matchField="^".expectedM."$"
| eval match=case(match(expectedm, matchField), "Yes", true(), "No")
| eval match1=if(expectedm=expectedM, "Yes", "No")
---
If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!