Similar to @bowesmana's idea but using a "feature" (or side effect if you like) of SPL's array operation, you can do | eval Match = mvmap(ID1, if(ID2 == ID1, "TRUE", null())) ``` null only if all tests fail ```
| eval Match = if(isnull(Match), "FALSE", "TRUE") Interestingly, when SPL evaluates equality between a single value with multivalue, it evaluates to true when any one of multivalue is true. The advantage here is regex match in mvfind can give you false match unless you format the parameters very carefully, or if all IDs are of equal length. For example, "123" can match "12345". (Additionally, regex is more expensive than simple ASCII equality.) Here is a demonstration with emulation of your sample data: | makeresults
| eval _raw="ID1 ID2
402830,602369 602369,244633
402830,840317,602369 602369,244633
152893,443482 602369,244633
227213,244633 602369,244633
422210,442824 602369,244633"
| multikv forceheader=1
| fields - _time _raw linecount
| foreach ID*
[eval <<FIELD>> = split(<<FIELD>>, ",")]
``` data emulation above ```
| eval Match = mvmap(ID1, if(ID2 == ID1, "TRUE", null()))
| eval Match = if(isnull(Match), "FALSE", "TRUE") You get ID1 ID2 Match 402830 602369 602369 244633 TRUE 402830 840317 602369 602369 244633 TRUE 152893 443482 602369 244633 FALSE 227213 244633 602369 244633 TRUE 422210 442824 602369 244633 FALSE
... View more