Splunk Search

match function is not working

Allampally
Path Finder

I have two fields called field1, field2. Both are having same value as "xyz" but when i try to compare them with match function, it is saying that both values are different. Output of below query is "No" but I am expecting the answer "Yes" as both are equal.
eval results1=if(field1=field2,"Yes","No")
If any field format make differ here ?

0 Karma

harishalipaka
Motivator

hi @Allampally

try below --

|eval results1=if(match(field1,field2),"Yes","No")

|eval results1=if(like(field1,field2),"Yes","No")

|eval results1=if(field1==field2,"Yes","No")

If you not get results using this.check your fields contains any spaces.

|eval field1=upper(trim(fied1)),field2=trim(upper(field2))
Thanks
Harish
0 Karma

renjith_nair
Legend

@Allampally ,
Try comparing it against the literal string. Probably a space or special characters might be the reason.

For .e.g try field1="xyz" and field2="xyz" separately and see if you are getting the expected result.

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

Allampally
Path Finder

That way, it is working but i have extracted one field using rex. Not sure that is causing any difference.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Raw Data to Executive-Ready Stories, Faster

Build Data Stories for Every Audience  A dashboard is rarely just a dashboard. It might be the view an ...

Guided Onboarding with Auto-schema Is Now Generally Available

  We are excited to announce the General Availability of Guided Onboarding with Auto-Schematization ...

ATTENTION: We’re Moving! (AGAIN!)

The Splunk Community Slack is undergoing a system migration to keep our workspace secure and ...