matching hostnames issue

[secure]

Hi

i have a list of servers coming from two different sources list A has server without domain names and list B has servers with and without domain names
i was trying to compare the two list and get matching and not matching value 

problem is bot the list have same server but because of domain name it says not matching 
i understand if function is probably not the correct choice and when i use case with like it give me error any suggestions on this  

|makeresults
| eval listA="xyz1apac" ,listB="xyz1apac.ent.bhpbilliton.net"
| append [| makeresults | eval listA="xyz2" ,listB="xyz2.ent.bhpbilliton.net"]
| append [| makeresults | eval listA="xyz3emea" ,listB="xyz3emea"]
| append [| makeresults | eval listA="xyz4abc" ,listB="xyz4abc.ent.bhpbilliton.net"]
| fields - _time
| eval matching=if(listA != listB, "NOT OK", "OK")

thanks

[yuanliu]

Like @livehybrid and yourself said, there are a milliard of method to perform match.  Here is another given that you know that listA does not contain domain name.

| eval matching=if(listA == mvindex(split(listB, "."), 0), "OK", "NOT OK")

split-mvindex is slightly less expensive than regex/match.  But the difference is really small.  The real question is like @livehybrid asked: Are there some constraints in your use case that would prefer one solution over another?

[livehybrid]

I just came on to suggest an mvindex/split approach as an alternative @yuanliu, but as you say, rex is probably most effective here!

Different ways for doing things, ultimately depends on the situation 🙂 

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

[livehybrid · Accepted solution]

Hi @secure 

You could use rex to get the first part of the hostname like this:

|makeresults
| eval listA="xyz1apac" ,listB="xyz1apac.ent.bhpbilliton.net"
| append [| makeresults | eval listA="xyz2" ,listB="xyz2.ent.bhpbilliton.net"]
| append [| makeresults | eval listA="xyz3emea" ,listB="xyz3emea"]
| append [| makeresults | eval listA="xyz4abc" ,listB="xyz4abc.ent.bhpbilliton.net"]
| fields - _time
| rex field=listA "(?<hostA>[^\.]+)"
| rex field=listB "(?<hostB>[^\.]+)"
| eval matching=if(hostA != hostB, "NOT OK", "OK")

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

[secure]

@livehybrid  thanks for the regex  is it possible through case with like or match function just trying to explore  all the possibilities 

[livehybrid]

Possibly, what is the overall goal? Just so I can make sure it’s suitable. 
thanks 

[secure]

@livehybrid my overall goal was to learn other methods as well, rex was something i was able to figure out earlier