topic Re: Why cant i supply a field as value for mvfilter? in Splunk Search

Why cant i supply a field as value for mvfilter?

christoffertoft — Wed, 30 Sep 2020 01:07:18 GMT

I'm trying to exclude a value from a multivalue list, but it only works when I input the string as a value, not as a field.

I understand that it takes a regex as part of its expression, so is there any way i can accommodate that?

Doesnt work.

| eval mymvfield ="a b c" | makemv mymvfield | eval excludes = mvfilter(NOT in(mymvfield, "b"))

works however. Ive tried $exclude_me$, "$exclude_me$" etc without luck..

I need to be able to exclude a value per row, based on the current value of exclude_me .. There has to be a way for this?

Re: Why cant i supply a field as value for mvfilter?

richgalloway — Thu, 27 Jun 2019 12:22:51 GMT

Have you tried 'exclude_me'?

Re: Why cant i supply a field as value for mvfilter?

christoffertoft — Thu, 27 Jun 2019 12:32:18 GMT

Hi rich, thanks for reply. I only get Error in 'eval' command: The arguments to the 'mvfilter' function are invalid. when i do | eval excludes = mvfilter( NOT in(mymvfield, 'exclude_me') )

Re: Why cant i supply a field as value for mvfilter?

christoffertoft — Thu, 27 Jun 2019 12:34:13 GMT

If i do the logic | where NOT 'exclude_me' in (mymvfield) the logic works. as soon as i put the exact same string as the argument to the boolean logic in mvfilter it breaks.

Re: Why cant i supply a field as value for mvfilter?

jplumsdaine22 — Thu, 27 Jun 2019 12:56:54 GMT

you could use a subsearch like:

| makeresults 
| eval mymvfield ="a b c" 
| makemv mymvfield 
| eval excludes = mvfilter(NOT in(mymvfield, 
    [| makeresults 
    | eval search = "\"b\"" 
    | return $search]))

| eval search = "\"b\"" would be replaced with your actual search, then literally rename the field you want to search
don’t quote me, but I don’t think the REGEX data type in splunk can be replaced with a field value, hence the need to use a subsearch to pass an actual string there
Note the value of search needs to be enclosed in " ", so you may need to do an eval before calling return to add the double quotes

Re: Why cant i supply a field as value for mvfilter?

tmontney — Mon, 27 Jul 2020 21:29:03 GMT

https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/MultivalueEvalFunctions#mvfilter.28X.29

mvfilter(!MyField LIKE "%not_this_text%")

Re: Why cant i supply a field as value for mvfilter?

vgtk4431 — Fri, 04 Dec 2020 15:53:49 GMT

More than 1 year late, but a solution without any subsearch is :

`mvmap` will apply a condition on all the field of the multivalue fields (in this case replace the excluded fields with "0"
then we filter on everything that is not "0"

Re: Why cant i supply a field as value for mvfilter?

elewis1 — Tue, 09 Nov 2021 15:27:22 GMT

Great solution. using null or "" instead of 0 seems to exclude the need for the last mvfilter.