eval alerting on matching fields.

[sbattista09]

i want to make an alert that will pop when two values in a event match.

index=foo_index  sourcetype=foofoo_prod| eval match=if(field1_foo==Filed2_foo,1,0)

The issues I am not sure of what eval function to use. 😞

[saurabhkharkar]

the if statement will return 1 if the fields match else it will return 0

| eval match=if(field1_foo==field2_foo,1,0)
| where match=1

If you want to set an alert - save the search where 'match=1' (to get events where the fields are same) as an alert where you can schedule it to run periodically or create a correlation search in Splunk ES to create a notable event.