https://community.splunk.com/t5/Getting-Data-In/Filter-results/m-p/38331#M7039 <P>Works like charm, thank you! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 24 May 2013 11:02:28 GMT rlautman 2013-05-24T11:02:28Z https://community.splunk.com/t5/Getting-Data-In/Filter-results/m-p/38329#M7037 <P>I have a search that returns a 2 multivalue fields, product and productstatus - I have used mvzip to combine the results of these fields into one, productandstatus - I want to filter these results in the search so that only certain rows are returned: for example</P> <P>Multivalued field productandstatus - I would only want Type1, regardless of status, to be returned</P> <P>Type1,acknowledged<BR /> Type1,cancelled<BR /> Type2,completed<BR /> Type4,cancelled</P> Fri, 17 May 2013 15:45:32 GMT https://community.splunk.com/t5/Getting-Data-In/Filter-results/m-p/38329#M7037 rlautman 2013-05-17T15:45:32Z https://community.splunk.com/t5/Getting-Data-In/Filter-results/m-p/38330#M7038 <P>That sounds like a job for mvfilter() together with match(), probably looking for "^Type1,".</P> Fri, 17 May 2013 22:23:14 GMT https://community.splunk.com/t5/Getting-Data-In/Filter-results/m-p/38330#M7038 martin_mueller 2013-05-17T22:23:14Z https://community.splunk.com/t5/Getting-Data-In/Filter-results/m-p/38331#M7039 <P>Works like charm, thank you! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 24 May 2013 11:02:28 GMT https://community.splunk.com/t5/Getting-Data-In/Filter-results/m-p/38331#M7039 rlautman 2013-05-24T11:02:28Z