{"id":19626,"date":"2020-08-28T20:35:23","date_gmt":"2020-08-28T20:35:23","guid":{"rendered":"https:\/\/merikebi.warrenmyers.com\/?p=19626"},"modified":"2020-08-28T20:35:23","modified_gmt":"2020-08-28T20:35:23","slug":"splunk-match-a-fields-value-in-another-field","status":"publish","type":"post","link":"https:\/\/merikebi.warrenmyers.com\/?p=19626","title":{"rendered":"splunk: match a field\u2019s value in another field"},"content":{"rendered":"

Had a Splunk<\/a> use-case present itself today on needing to determine if the value<\/em> of a field was found in another – specifically, it’s about deciding if a lookup table’s category name for a network endpoint is “the same” as the dest_category<\/code> assigned by a Forescout CounterACT appliance.<\/p>\n

We have “customer validated” (and we all know how reliable that<\/em> kind of data can be… (the customer is always wrong<\/strong><\/em><\/a>) names for network endpoints.<\/p>\n

These should<\/em> be “identical” to the dest_category<\/code> field assigned by CounterACT … but, as we all know, “should” is a funny word.<\/p>\n

What I tried<\/em> (that does not work) was to get like()<\/code><\/a> to work:<\/p>\n

| eval similar=if(like(A,'%B%') OR like(B,'%A%'), \"yes\", \"no\")<\/code><\/p>\n

I tried a slew<\/em> of variations around the theme of trying to get the value of the field to be in the match portion of the like()<\/code>.<\/p>\n

What I ended-up doing (that does<\/em> work) is this:<\/p>\n

| eval similar=if((match(A,B) OR match(B,A)), \"yes\", \"no\")<\/code><\/p>\n

That<\/em> uses the value<\/em> of the second field listed to be the regular expression<\/a> clause of the match()<\/a><\/code> function.<\/p>\n

Things you should do ahead of time:<\/p>\n