comparing two string doesn't work

[rezaeimo]

i have a search query and i want to add another condition to check the url if test!=staging. the first test is coming as a parameter and could be test, staging or prod. i've done following query but test!=staging part doesn't work and not returning as true. 

index="my_index"
AND (test!=staging OR "Properties.URL"="*stg*")
source=Payments

[rezaeimo]

i've used where key word like the following. now the first condition works but the second condition doesn't work. name is a parameter that could be test, staging or prod. do you have any idea why the second condition doesn't work?

index="my_index"
source=Payments
|where ("#{name}"!="staging" OR "Properties.URL" like "%stg%")

[PickleRick]

You're comparing two strings which will never match.

You need to use single quotes for the field name

'Properties.URL' like "%stg%"

[gcusello]

Hi @rezaeimo ,

I'm not sure about the conditions you used and sometimes the dot in the field name gives problems, so please try this:

index="my_index" source=Payments
| rename Properties.URL AS URL
| search ("test"!="staging" OR URL like "%stg%")

Ciao.

Giuseppe

[rezaeimo · Accepted solution]

great idea to use rename, thanks for that. . didn't worked with search but i've used rename and where and it got it working. here is what worked for me.

index="my_index"
source=Payments
|rename "Properties.URL" as Url 
|where ("#{name}"!="staging" OR Url like "%stg%")

[gcusello]

Hi @rezaeimo,

as I said, this is a frequent issue that I don't understand why someone in Splunk doesn't resolve!

Anyway, 

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[PickleRick]

That's not a real issue. If you have field names consisting of more than just alphanumeric characters, you use single quotes to define them. In fact you can use the single quotes every time, it's just that with "simple" field names you can omit them.

[gcusello]

Hi @rezaeimo,

you could try using quotes for the staging value:

index="my_index" (test!="staging" OR "Properties.URL"="*stg*") source=Payments

or you could try the other conditions: it's alwayes beter to use positive condition than negative ones:

index="my_index" (test IN ("test","prod") OR "Properties.URL"="*stg*") source=Payments

Ciao.

Giuseppe

[rezaeimo]

for me the fix was to use where keyword.

index="my_index"
source=Payments
|search ("test" !="staging" OR "Properties.URL"="*stg*")

[gcusello]

Hi @rezaeimo,

you don't need to use the search command after the main search, this ommand is used only if you have to use a field not defined in the main search.

in addition you don't need to use quotes for fields without spaces or special chars.

Ciao,.

Giuseppe