https://community.splunk.com/t5/Splunk-Search/extract-multi-valued-field/m-p/413609#M119206 <P>@rashid47010 <BR /> Can you please try this?</P> <PRE><CODE>YOUR_SEARCH | where isnull(mvfind(fieldname,"value2")) </CODE></PRE> <P><STRONG>My Sample Search:</STRONG></P> <PRE><CODE>| makeresults | eval fieldname="value1,value2" | append [| makeresults | eval fieldname="value1,value3"] | eval fieldname = split(fieldname,",") | where isnull(mvfind(fieldname,"value2")) </CODE></PRE> <P>Thanks</P> Thu, 25 Jul 2019 11:59:20 GMT kamlesh_vaghela 2019-07-25T11:59:20Z https://community.splunk.com/t5/Splunk-Search/extract-multi-valued-field/m-p/413608#M119205 <P>HI everyone,</P> <P>the filed containst two values. one in each line.</P> <P>fieldname = value1<BR /> value2</P> <P>How can we exlude the results with the fieldname contains value2.</P> Thu, 25 Jul 2019 09:41:14 GMT https://community.splunk.com/t5/Splunk-Search/extract-multi-valued-field/m-p/413608#M119205 rashid47010 2019-07-25T09:41:14Z https://community.splunk.com/t5/Splunk-Search/extract-multi-valued-field/m-p/413609#M119206 <P>@rashid47010 <BR /> Can you please try this?</P> <PRE><CODE>YOUR_SEARCH | where isnull(mvfind(fieldname,"value2")) </CODE></PRE> <P><STRONG>My Sample Search:</STRONG></P> <PRE><CODE>| makeresults | eval fieldname="value1,value2" | append [| makeresults | eval fieldname="value1,value3"] | eval fieldname = split(fieldname,",") | where isnull(mvfind(fieldname,"value2")) </CODE></PRE> <P>Thanks</P> Thu, 25 Jul 2019 11:59:20 GMT https://community.splunk.com/t5/Splunk-Search/extract-multi-valued-field/m-p/413609#M119206 kamlesh_vaghela 2019-07-25T11:59:20Z