topic Re: How to Filter out rows when multivalues are present in Reporting

How to Filter out rows when multivalues are present

cindygibbs_08 — Sun, 27 Jun 2021 23:36:43 GMT

Hello everyone I hope you guys are doing just great!

I have a sort of simple question but I have not been able to come up with a solution.. I want to be able to filter out rows of a table where there are multivalues based a numeric criteria, this is an example:

I have this:

AGENT

INX

ROCKS

TASK

XX_9

-6

TY-8

GY-0

FG-67

XX_10

-49

-66

UJI

TY-8E

G-0

VG-67

I would like to only remove all rows in the table where the multivalue field "INX" have negative numbers and have something like this:

AGENT

INX

ROCKS

TASK

XX_9

TY-8

GY-0

XX_10

TY-8E

I have tried using mvfilter and mvfind and mvindex but... every trial has not been successful yet so I really love you guys for helping me out thanks a LOTTTT

kindly,

Cindy

Re: How to Filter out rows when multivalues are present

kamlesh_vaghela — Mon, 28 Jun 2021 05:13:21 GMT

@cindygibbs_08

Can you please try this?

YOUR_SEARCH | eval t=mvzip(mvzip(INX,ROCKS),TASK) | stats count by AGENT,t | eval INX= mvindex(split(t,","),0), ROCKS=mvindex(split(t,","),1), TASK=mvindex(split(t,","),2) | where INX > 0 | stats list(INX) as INX list(ROCKS) as ROCKS list(TASK) as TASK by AGENT

My Sample Search :

| makeresults | eval _raw="AGENT INX ROCKS TASK XX_9 7|9|-6 T|Y|U TY-8|GY-0|FG-67 XX_10 7|-49|-66 UY|IO|UJI TY-8E|G-0|VG-67 " | multikv forceheader=1 | eval INX=split(INX,"|"), ROCKS=split(ROCKS,"|"), TASK=split(TASK,"|") | rename comment as "Upto Now is sample data only" | eval t=mvzip(mvzip(INX,ROCKS),TASK) | stats count by AGENT,t | eval INX= mvindex(split(t,","),0), ROCKS=mvindex(split(t,","),1), TASK=mvindex(split(t,","),2) | where INX > 0 | stats list(INX) as INX list(ROCKS) as ROCKS list(TASK) as TASK by AGENT

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: How to Filter out rows when multivalues are present

cindygibbs_08 — Mon, 28 Jun 2021 18:58:42 GMT

Hello @kamlesh_vaghela thank you so much for your help, I have one final question... would this example still stand for multiple cases... not just this particular one but for all that are like this... moreover does the mvzip function truncate after a number of statistics?

Re: How to Filter out rows when multivalues are present

kamlesh_vaghela — Tue, 29 Jun 2021 04:37:52 GMT

@cindygibbs_08

Yes, the sample example will work with similar use cases also.

mvzip used for combining two multivalued fields and no truncation I have faced ever with mvzip. 🙂

https://docs.splunk.com/Documentation/SCS/current/SearchReference/MultivalueEvalFunctions#mvzip.28.26lt.3Bmv_left.26gt.3B.2C_.26lt.3Bmv_right.26gt.3B.2C_.26lt.3Bdelim.26gt.3B.29

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: How to Filter out rows when multivalues are present

kamlesh_vaghela — Thu, 01 Jul 2021 05:03:05 GMT

@cindygibbs_08
Glad to help you. You suppose to accept one of my answer. 🙂