Splunk Search

match function is not working

Allampally
Path Finder

I have two fields called field1, field2. Both are having same value as "xyz" but when i try to compare them with match function, it is saying that both values are different. Output of below query is "No" but I am expecting the answer "Yes" as both are equal.
eval results1=if(field1=field2,"Yes","No")
If any field format make differ here ?

0 Karma

harishalipaka
Motivator

hi @Allampally

try below --

|eval results1=if(match(field1,field2),"Yes","No")

|eval results1=if(like(field1,field2),"Yes","No")

|eval results1=if(field1==field2,"Yes","No")

If you not get results using this.check your fields contains any spaces.

|eval field1=upper(trim(fied1)),field2=trim(upper(field2))
Thanks
Harish
0 Karma

renjith_nair
Legend

@Allampally ,
Try comparing it against the literal string. Probably a space or special characters might be the reason.

For .e.g try field1="xyz" and field2="xyz" separately and see if you are getting the expected result.

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

Allampally
Path Finder

That way, it is working but i have extracted one field using rex. Not sure that is causing any difference.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

Data Management Digest – May 2026

Welcome to the May 2026 edition of Data Management Digest!   As your trusted partner in data innovation, the ...