Why do match and like not working for some users?

[Manasa_401]

Hello Splunkers!!

We have a dashboard which works on the loadjob. When users try accessing the dashboard, they are getting "No results found" message. First I thought problem with permissions, but out of 4 colleagues with same admin access as mine, 3 members are able to see the dashboard results. So it seems it is not problem with permissions.

To figure out the problem in query, we back traced the logic line by line and found the line from where user is not getting 0 results.

Search Query:

|loadjob reportname
.....some evals & lookups....
|eval valid=if(match(backlog_dates,e_time),"yes","no") | search valid=yes --->no results from this line

replaced 'match' with 'like' but still no results

tried the below line but same issue.
| where backlog_dates like e_time

Checked the logs for both users who are able to get results and who are not able to get results. But nothing to suspect and no errors in log.

It is very strange that it is working for some users.

Please help me on figuring out the issue.

Below is the sample data

[richgalloway]

I suspect there may be some strange behavior happening because backlog_dates is a multi-value field. Try using the mvfind function.

|loadjob reportname .....some evals & lookups.... |eval valid=if(mvfind(backlog_dates,e_time),"yes","no") | search valid=yes

[Manasa_401]

Thanks for your answer @richgalloway
I tried this :-- | where !isnull(mvfind(backlog_dates,e_time))
mvfind function does the job, but the problem is not all users are able to see the results after this line.

Users can see the backlog_dates and e_time field values but the comparison line is not working for them(zero results)

As an Admin I am able to get the results after the mvfind. Strange thing is only few users having admin access are able to see the results but not all.
Kindly help me to troubleshoot

[richgalloway]

That's very strange. The where command and isnull and mvfind functions are not access-controlled. All users should be able to use them and view their output.

Try where isnotnull(mvfind(backlog_dates, e_time)) as an alternative.

[PickleRick]

Indeed, it seems so. While searching with

| search field="value"

yields results if any of the values of the multivalued field match given constant value, matching with where like(...) or where match(...) against multivalued field fails. You can't match two identical multivalued fields either.