topic Re: Remove field-value from multivalue in Splunk Enterprise

Remove field-value from multivalue

siv — Thu, 17 Jul 2025 13:08:23 GMT

I have this table for example

Field1 | Field2

Value1 | value1 value2 value3

Field2 is mv

I want to remove the value that already axits in field1 so the result be like this:

Field1 | Field2

Value1 | value2, value3

I didnt see the mvfilter support this

Re: Remove field-value from multivalue

ITWhisperer — Thu, 17 Jul 2025 13:33:53 GMT

| foreach mode=multivalue Field2 [| eval new=if(<<ITEM>>!=Field1,mvappend(new,<<ITEM>>),new)]

Re: Remove field-value from multivalue

siv — Thu, 17 Jul 2025 14:21:08 GMT

I think i tried that,

But i found a solution with mvmap and if match...

Re: Remove field-value from multivalue

bowesmana — Thu, 17 Jul 2025 23:35:54 GMT

The simplest way is to use = rather than match, unless you need match. The problem with match is if your data contains anything that might be significant to the regular expression, e.g. if Value 1 is Va*ue, then that won't work well with match.

You can do it like this - example shows simple fields in Field1, 2 and 3 and then one with regex significant characters and shows Field6 works, but not Field7

| makeresults | fields - _time | eval Field1="Value 1", Field2=split("Value 1,Value 2,Value 3", ",") | eval Field3=mvmap(Field2, if(Field1=Field2, null(), Field2)) | eval Field4="Odd[Regex Chars?]Value 1", Field5=split("Odd[Regex Chars?]Value 1,Value 2,Value 3", ",") | eval Field6_using_equals=mvmap(Field5, if(Field4=Field5, null(), Field5)) | eval Field7_using_match=mvmap(Field5, if(match(Field4,Field5), null(), Field5))

Re: Remove field-value from multivalue

PrewinThomas — Fri, 18 Jul 2025 03:59:24 GMT

@siv

You can consider using mvfilter as well.

| makeresults | eval Field1="Value 1" | eval Field2=split("Value 1,Value 2,Value 3", ",") | eval Field2=mvfilter(match(Field2, "^(?!Value 1$).*"))

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: Remove field-value from multivalue

livehybrid — Fri, 18 Jul 2025 07:52:58 GMT

Hi @siv

How about

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing