topic Re: filter multivalue of strings by substring/character in Dashboards & Visualizations

How to filter multivalue of strings by substring/character?

Kubousky — Wed, 23 Mar 2022 22:44:05 GMT

I need to filter multivalue of strings by substring/character.

field coordinatorsID: a##1, b##2, c##3, d##3

field expertiseLevel can be one of "1", "2", "3"

Exmple:

expertiseLevel = "3"

result -> c##3, d##3

What I tried:

attempt1:

| eval coordinatorsID_filtered = mvfilter(like(coordinatorsID,"%$expertiseLevel$")) error

attempt2:

| eval expertiseLevel = case(expertiseLevel == "1", "%1", expertiseLevel == "2", "%2", expertiseLevel == "3", "%3")

| eval coordinatorsID_filtered = mvfilter(like(coordinatorsID,$expertiseLevel$)) null

Re: filter multivalue of strings by substring/character

tshah-splunk — Wed, 23 Mar 2022 11:53:04 GMT

Hey @Kubousky,

If the field coordinatorsID is present as a column of the table, try expanding the field using mvexpand first, and then extract the field expertiseLevel from the coordinatorsID using regex. This will create a separate column for the expertiseLevel and then you can filter your data using the search command. Roughly your query should look something like this

<<your_base_query>> | mvexpand coordinatorsID | rex field=coordinatorsID "[a-zA-Z]##(?<expertiseLevel>\d)" | search expertiseLevel="3"