New to Splunk and banging my head against the wall with this problem for over a day now. Please help... Need to compare two different fields from two different events to determine whether the values of those fields match. I ran a search that returns events. All events have an ACCOUNT_NUM field. Depending on the event, it will have either a DATE_TYPE1 field or a DATE_TYPE2 field. The report should display each distinct ACCOUNT_NUM that has one of each DATE_TYPE - so, a column for ACCOUNT NUM, a column for DATE_TYPE1, a column for DATE_TYPE2, and a column for DATE_STATUS ("Match" or "No Match") to indicate whether the two dates match.  So far, I have:   | stats values(DATE_TYPE1) AS "Date One" values(DATE_TYPE2) AS "Date Two" count by ACCOUNT_NUM | where count > 1   This groups the distinct ACCOUNT_NUM and shows me the two DATE_TYPES but how do I indicate whether the two dates match? I tried adding:   | eval DATE_STATUS=if(DATE_TYPE1=DATE_TYPE2, "Match", "No Match")   but this returns "No Match" for all of the events. My understanding is this is because    | eval   is evaluating each event individually. Since no event has both date types, it is not finding a match. How can I get it to compare the date types of each distinct account number as grouped together by my   | stats   command? ... View more