Splunk Search

match function is not working

Allampally
Path Finder

I have two fields called field1, field2. Both are having same value as "xyz" but when i try to compare them with match function, it is saying that both values are different. Output of below query is "No" but I am expecting the answer "Yes" as both are equal.
eval results1=if(field1=field2,"Yes","No")
If any field format make differ here ?

0 Karma

harishalipaka
Motivator

hi @Allampally

try below --

|eval results1=if(match(field1,field2),"Yes","No")

|eval results1=if(like(field1,field2),"Yes","No")

|eval results1=if(field1==field2,"Yes","No")

If you not get results using this.check your fields contains any spaces.

|eval field1=upper(trim(fied1)),field2=trim(upper(field2))
Thanks
Harish
0 Karma

renjith_nair
Legend

@Allampally ,
Try comparing it against the literal string. Probably a space or special characters might be the reason.

For .e.g try field1="xyz" and field2="xyz" separately and see if you are getting the expected result.

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

Allampally
Path Finder

That way, it is working but i have extracted one field using rex. Not sure that is causing any difference.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Cisco Data Fabric from Architecture to Investigation, Better SOC Visibility, and More ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

The Trust Gap: Why a Data Foundation is Fundamental to an Agentic Enterprise

The Trust Gap: Why a data foundation is fundamental to an  Agentic Enterprise.   Agentic AI is transforming ...

Data Management Digest – September 2026

    Welcome to the September 2026 edition of Data Management Digest! September brought a fresh wave of ...