One solution:
Case sensitive matching:
search ... | eval results = if(match(field2,field1), "hit", "miss")
Case insensitive matching:
search ... | eval results = if(match(upper(field2),upper(field1)), "hit", "miss")
I hope this helps others. I tried quite a few other ways before discovering this.
... View more