topic Trying to get eval to push multiple values to one field in Getting Data In

Trying to get eval to push multiple values to one field

doingathing — Mon, 18 Nov 2024 16:43:15 GMT

Currently trying to get eval to give multiple returns

| eval mitre_category="persistence,Defense_Evasion" | eval apt="apt1,apt2,apt3"

I would like the values to be listed as OR. that way i get `apt2` or `apt3` instead of searching for `apt1,apt2,apt3`. I would like to know if there is a way to do this via one query instead of several if at all possible.

Re: Trying to get eval to push multiple values to one field

ITWhisperer — Mon, 18 Nov 2024 17:48:56 GMT

It is not clear what you are trying to do. Are you trying to search for events where the field may have one of a number of different values?

| search apt IN ("apt1","apt2","apt3")

Re: Trying to get eval to push multiple values to one field

richgalloway — Mon, 18 Nov 2024 18:23:11 GMT

Create a multi-value field using mvappend (there are other ways, too).

| eval mitre_category=mvappend("persistence","Defense_Evasion") | eval apt=mvappend("apt1","apt2","apt3")

The search command, however, doesn't work well with multi-value fields so this probably will not solve your problem. What problem are you trying to solve, exactly? Tell us about the root problem so we can offer other possible answers.