topic Re: why do matchesValue and matchesPhrase give different results in this case? in DQL

why do matchesValue and matchesPhrase give different results in this case?

GerryIsHere — Thu, 21 Mar 2024 10:30:41 GMT

Here are two queries, I don't understand why the results are different (same time period 24 hours):

fetch logs
| filter matchesPhrase(host.name, "tar04*")
| summarize collectDistinct(host.name)

tar045.dcmax.local
tar046.dcmax.local

fetch logs
| filter matchesValue(host.name, "tar04*")
| summarize collectDistinct(host.name)

tar040.dcmax.local
tar041.dcmax.local
tar045.dcmax.local
tar046.dcmax.local

Re: why do matchesValue and matchesPhrase give different results in this case?

cesarsaravia — Wed, 20 Mar 2024 20:40:18 GMT

Hi @GerryIsHere
The only difference between those functions are the validations that matchesPhrase realizes.

Tried to replicate your scenario with the same data, and in both cases the result is the same.

Could you get us more context?
Regards,

Re: why do matchesValue and matchesPhrase give different results in this case?

GerryIsHere — Wed, 20 Mar 2024 20:44:20 GMT

the logs are from WebLogic servers, I think there is 1-2 million logs a day. If I run the queries just counting the number of logs matchesPhrase finds way fewer logs. The host.names are exactly as shown.

Re: why do matchesValue and matchesPhrase give different results in this case?

GerryIsHere — Wed, 20 Mar 2024 20:45:20 GMT

doesn't support mid-string wildcards, except some of the time when it does apparently!