If Field2 is a multivalued field, this will work
yoursearchhere
| eval n=mvfind(Field2,Field1)
| eval FoundIt = if(isnotnull(n),True,False)
Otherwise, try this
yoursearchhere
| eval FoundIt = if(match(Field2,Field1),True,False)
For either of these solutions to work, Field1 cannot contain any regular expression special characters:
\ ^ $ . | ? * + ( ) [ {
If Field2 is a multivalued field, this will work
yoursearchhere
| eval n=mvfind(Field2,Field1)
| eval FoundIt = if(isnotnull(n),True,False)
Otherwise, try this
yoursearchhere
| eval FoundIt = if(match(Field2,Field1),True,False)
For either of these solutions to work, Field1 cannot contain any regular expression special characters:
\ ^ $ . | ? * + ( ) [ {
Thanks lguinn.. It worked 🙂