topic Re: Best Way to Find if Field Matches a Value in an MV Field in Dashboards & Visualizations

Best Way to Find if Field Matches a Value in an MV Field

strehb18 — Wed, 08 Dec 2021 19:53:39 GMT

Hello,

I am wondering what the best way to find a value in one my fields matches what is in a mv field. I cannot use mv expand and a where due to the storage limit I encounter. Is there a way to show that "match" matches with the values in field2, but "miss" would not.

Re: Best Way to Find if Field Matches a Value in an MV Field

richgalloway — Wed, 08 Dec 2021 20:41:47 GMT

Try mvfind

| eval found = mvfind(field2, field1)

Re: Best Way to Find if Field Matches a Value in an MV Field

ldongradi_SPL — Fri, 10 Dec 2021 23:56:25 GMT

Try where like. It can compare with any value inside the mv field.

| where field1 LIKE (field2)