Splunk Search

compare fields for like match

rg33
Explorer

I am looking for methods to compare two fields for a like match.

Specifically, I'd like to match when field1 can be found within field2. Also, I would like the comparison to be support either case sensitive or insensitive options. Fuzzy matching, including degree of similarity or confidence values, would also be helpful.

For example, given two events:

event1  field1="race"  field2="Racecar"
event2  field1="jump"  field2="Rope"
event3  field1="flip"  field2="BackFlip"

Desired result:

  event1  result=hit
  event2  result=miss
  event3  result=hit

Thanks in advance for your suggestions.

-rg

1 Solution

rg33
Explorer

One solution:

Case sensitive matching:

search ... | eval results = if(match(field2,field1), "hit", "miss") 

Case insensitive matching:

search ... | eval results = if(match(upper(field2),upper(field1)), "hit", "miss") 

I hope this helps others. I tried quite a few other ways before discovering this.

View solution in original post

rg33
Explorer

One solution:

Case sensitive matching:

search ... | eval results = if(match(field2,field1), "hit", "miss") 

Case insensitive matching:

search ... | eval results = if(match(upper(field2),upper(field1)), "hit", "miss") 

I hope this helps others. I tried quite a few other ways before discovering this.

mad4wknds
Path Finder

I downvoted this post because error in 'eval' command: the arguments to the 'if' function are invalid.

0 Karma

rg33
Explorer

I fixed the error. Sorry for the typo.

0 Karma

xploresplunk
New Member

How would you get the time for which these two fields matched each other? Further, if it matches several times how would you get the first time they matched (earliest time)?

0 Karma

countermancs
New Member

I am trying to match a the values of a 1 field with the values of another field .

When i use this eval I get Error in 'eval' command: The arguments to the 'match' function are invalid.

any ideas?

0 Karma

dfqobvbkmnpi
Explorer

looks like you have an extra ) or not enough ( in the case sensitive solution.

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Is this both question and answer? If so, you should edit it so the answer appears in an answer response below. That is more clear and you can get karma for a correct answer to your question and a "self-learner" badge for answering your own question 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...