topic Re: Filtering on specific multivalue field value in Splunk Search

Filtering on specific multivalue field value

frbuser — Tue, 15 Jan 2019 16:39:20 GMT

How do I return results based on a specific value of a multivalue field?

Example
returns all results where the 1st value of a multivalue field equals foo.

Re: Filtering on specific multivalue field value

richgalloway — Tue, 15 Jan 2019 18:01:06 GMT

Something like | where mvindex(myField, 0)="foo" ?

Re: Filtering on specific multivalue field value

vnravikumar — Tue, 15 Jan 2019 18:07:54 GMT

Hi @frbuser

Please try

| makeresults 
| eval test_column="test,cpu,foo,digit" 
| append 
    [| makeresults 
    | eval test_column="foo,one,two"] 
| makemv delim="," test_column 
| eval found=mvfind(test_column,"foo") 
| search found=0

Here found=0 when foo appears as first value

Re: Filtering on specific multivalue field value

frbuser — Wed, 16 Jan 2019 14:28:47 GMT

This requires that you retrieve a subset of events first. Is there anyway to do this earlier within a search command?

Otherwise it makes the query less efficient because I have to retrieve a high volume of events then further filter it with "where".

Re: Filtering on specific multivalue field value

frbuser — Wed, 16 Jan 2019 14:32:25 GMT

This requires adding a new field to every event. Is there anyway to do this via the initial search command?

The whole purpose is to retrieve the required events and doing it this way would require me to retrieve a larger subset first which is not very efficient in my case.

For some background, I am working with Windows event logs and I am filtering based on the Account_Name field. This field is however a multivalue field.

If I filter by any other criteria first, the query takes a long time to execute because there are so may logs to iterate through.

Re: Filtering on specific multivalue field value

richgalloway — Thu, 17 Jan 2019 13:52:26 GMT

It would help to see some sample events.

Re: Filtering on specific multivalue field value

wmyersas — Thu, 17 Oct 2019 18:44:15 GMT

Expanding on @richgalloway's answer, you can do this:

index=ndx sourcetype=srctp mvfield="foo"
| where mvindex(mvfield,0)="foo"

Doing the mvfield="foo" in the first line of the search will throw-away all events where that individual value is not in the multivalue field.

Then the | where clause will further trim it