Greetings Splunkers, I've been banging my head against the keyboard to try and resolve this comparison issue, I know there's a way to do it I just can't seem to figure it out. The issue I'm trying to resolve is determining if a user has a conflict of interest with regard to roles their user has been assigned, and what management deems inappropriate, segregation of duties basically. I get my list of conflicting roles from a lookup. - lookup SoD.csv Department as Department OUTPUTNEW Conflicting_Roles, Justification So if USER_A is within the Finance department and assigned roles A, B, and C OR A, B, and Z for example it would be a conflict because they still have A & B. I can get a proper result when I manually input the roles within a case statement. Conflict=case(Assigned_Role=Role_B AND Assigned_Role=Role_C, "Conflict",1=1,"No Conflict") However, given the conflicting roles change based on the department, it will be easier, in the long run, to maintain a lookup for conflicting roles than continuously updating the query. I've also tried the following but none seem to work: Conflict=case(in(Roles,Conflicting_Roles), "True",1=1, "False") Conflict=if(isnotnull(mvfind(Roles,Conflicting_Roles)),"Matched","Not Matched") Conflict=if(match(Roles,Conflicting_Roles),"Conflict","No Conflict") None seem to work as I need though, any thoughts or suggestions are greatly appreciated. Thank you
... View more