topic Re: search values inside MV in Splunk Search

search values inside MV

hok2010 — Sat, 03 Aug 2019 13:18:03 GMT

Hello All,

i need a help in creating report

i have a mv field called "report", i want to search for values so they return me the result.
i tried with "IN function" , but it is returning me any values inside the function.
to be particular i need those values in mv field

for example, i have two fields manager and report, report having mv fields

manger------------------------ report
john ------------------ day1
------------------ day2
------------------ day3

------------------ day4

kevin -------------- day1
------------------ day4
index="my search" | where in(report,"day1","day4")

so here i'm expecting only results for kevin

i dont want to mv index it into multiple fields!

Re: search values inside MV

arjunpkishore5 — Sat, 03 Aug 2019 13:48:08 GMT

Have you tried | search report IN ("day1", "day4")

Re: search values inside MV

askkawalkar — Sat, 03 Aug 2019 14:01:34 GMT

Hi @hok2010 ,

You can use additionally mvcount function in where condition

Please try below run anywhere query-

   | makeresults 
     | eval data="john|day1,day2,day3,day4;Kevin|day1,day2;" 
     | makemv data delim=";" 
     | mvexpand data 
     | makemv data delim="|" 
     | eval Manager=mvindex(data,0),report=mvindex(data,1)
    | makemv report delim=","
    | fields Manager,report
    | where in(report,"day1","day2") and mvcount(report)=2

Thanks

Re: search values inside MV

hok2010 — Sat, 03 Aug 2019 15:49:28 GMT

hi arjun,
it didnt work well im getting the same results