https://community.splunk.com/t5/Splunk-Enterprise-Security/Substituting-values-from-MV-fields/m-p/300542#M2647 <P>It seems a bit much to have to do, but this would work, as long as some value is selected...</P> <P>Instead of ...</P> <PRE><CODE> index=foo my_field_in_the_search=$myfield_in_the_notable$ </CODE></PRE> <P>...you could code the search...</P> <PRE><CODE> index=foo [| makeresults |eval my_field_in_the_search=$myfield_in_the_notable$ | makemv delim="," my_field_in_the_search | mvexpand my_field_in_the_search | table my_field_in_the_search | format] </CODE></PRE> <P>And the <CODE>format</CODE> command will turn it into ...</P> <PRE><CODE>((my_field_in_the_search=value1) OR (my_field_in_the_search=value2)....) </CODE></PRE> Mon, 03 Apr 2017 22:01:54 GMT DalJeanis 2017-04-03T22:01:54Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Substituting-values-from-MV-fields/m-p/300541#M2646 <P>In Enterprise Security, for a drill down action I want to use a field from the notable events, which can have multi valued fields as well.</P> <P>In this case, if I simply do my_field_in_the_search=$myfield_in_the_notable$ in the drilldown search, the values are presented as follows:</P> <P>my_field_in_the_search=value1,value2,value3 </P> <P>It cannot be used like this obviously, I would like to achieve something like</P> <P>my_field_in_the_search=value1 OR my_field_in_the_search=value2, etc...</P> <P>Is it possible to do this somehow?</P> Tue, 29 Sep 2020 13:26:52 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Substituting-values-from-MV-fields/m-p/300541#M2646 szabados 2020-09-29T13:26:52Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Substituting-values-from-MV-fields/m-p/300542#M2647 <P>It seems a bit much to have to do, but this would work, as long as some value is selected...</P> <P>Instead of ...</P> <PRE><CODE> index=foo my_field_in_the_search=$myfield_in_the_notable$ </CODE></PRE> <P>...you could code the search...</P> <PRE><CODE> index=foo [| makeresults |eval my_field_in_the_search=$myfield_in_the_notable$ | makemv delim="," my_field_in_the_search | mvexpand my_field_in_the_search | table my_field_in_the_search | format] </CODE></PRE> <P>And the <CODE>format</CODE> command will turn it into ...</P> <PRE><CODE>((my_field_in_the_search=value1) OR (my_field_in_the_search=value2)....) </CODE></PRE> Mon, 03 Apr 2017 22:01:54 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Substituting-values-from-MV-fields/m-p/300542#M2647 DalJeanis 2017-04-03T22:01:54Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Substituting-values-from-MV-fields/m-p/300543#M2648 <P>This is great, thanks!</P> Thu, 06 Apr 2017 11:06:46 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Substituting-values-from-MV-fields/m-p/300543#M2648 szabados 2017-04-06T11:06:46Z