not sure where you're getting this, I used this example:
| stats count | eval foo="tom,sally,foo"| makemv foo delim="," | eval bar="tom, bob, world"| makemv foo delim="," | makemv bar delim="," | mvexpand foo | mvexpand bar | eval equals=if(foo==bar,"1", "0") | where equals="1"
this gives the result:
count bar equals foo
0 tom 1 tom
you should also be able to skip a step and do:
| stats count | eval foo="tom,sally,foo"| makemv foo delim="," | eval bar="tom, bob, world"| makemv foo delim="," | makemv bar delim="," | mvexpand foo | mvexpand bar | where foo=bar
and forget the eval. if you need to escape the field, wrap it in $
| stats count | eval foo="tom,sally,foo"| makemv foo delim="," | eval bar="tom, bob, world"| makemv foo delim="," | makemv bar delim="," | mvexpand foo | mvexpand bar | where foo=$bar$
seems like your rex may not be mirroring the fields.
... View more