The simplest way is to use = rather than match, unless you need match. The problem with match is if your data contains anything that might be significant to the regular expression, e.g. if Value 1 is...
See more...
The simplest way is to use = rather than match, unless you need match. The problem with match is if your data contains anything that might be significant to the regular expression, e.g. if Value 1 is Va*ue, then that won't work well with match. You can do it like this - example shows simple fields in Field1, 2 and 3 and then one with regex significant characters and shows Field6 works, but not Field7 | makeresults | fields - _time
| eval Field1="Value 1", Field2=split("Value 1,Value 2,Value 3", ",")
| eval Field3=mvmap(Field2, if(Field1=Field2, null(), Field2))
| eval Field4="Odd[Regex Chars?]Value 1", Field5=split("Odd[Regex Chars?]Value 1,Value 2,Value 3", ",")
| eval Field6_using_equals=mvmap(Field5, if(Field4=Field5, null(), Field5))
| eval Field7_using_match=mvmap(Field5, if(match(Field4,Field5), null(), Field5))