https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-for-a-multivalue-field/m-p/485062#M193519 <P>| makeresults<BR /> | eval my_multival="4726,4722,4726"<BR /> | makemv tokenizer="([^,]+),?" my_multival</P> <P>this is the sample one i m using... that result id will contain data like below<BR /> 4726<BR /> 4726<BR /> 4722<BR /> 4726<BR /> 4726<BR /> 4726<BR /> 4722<BR /> 4726</P> Wed, 30 Sep 2020 03:41:50 GMT gndivya 2020-09-30T03:41:50Z https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-for-a-multivalue-field/m-p/485060#M193517 <P>I have a multivalue field which is got from a stats function. using mvfind function, how to write regex for this.</P> <P>query...|stats list(result_id) by user</P> <P>result_id is a multivalue field and it contains data like</P> <P>r_id1<BR /> r_id2<BR /> r_id3<BR /> r_id4</P> <P>I want to write a regex which matches as below<BR /> r_id2<BR /> r_id3</P> <P>but the below eval doesnt work.</P> <P>eval n=mvfind(result_id,"r_id2\nr_id3") <BR /> OR <BR /> eval n=mvfind(result_id,"r_id2\sr_id3") </P> <P>please help.</P> Wed, 30 Sep 2020 03:41:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-for-a-multivalue-field/m-p/485060#M193517 gndivya 2020-09-30T03:41:44Z https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-for-a-multivalue-field/m-p/485061#M193518 <P>Hi @gndivya,<BR /> to help you in regex creating, could you share some example (eventually masked!)?<BR /> Ciao.<BR /> Giuseppe</P> Mon, 20 Jan 2020 10:16:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-for-a-multivalue-field/m-p/485061#M193518 gcusello 2020-01-20T10:16:49Z https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-for-a-multivalue-field/m-p/485062#M193519 <P>| makeresults<BR /> | eval my_multival="4726,4722,4726"<BR /> | makemv tokenizer="([^,]+),?" my_multival</P> <P>this is the sample one i m using... that result id will contain data like below<BR /> 4726<BR /> 4726<BR /> 4722<BR /> 4726<BR /> 4726<BR /> 4726<BR /> 4722<BR /> 4726</P> Wed, 30 Sep 2020 03:41:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-for-a-multivalue-field/m-p/485062#M193519 gndivya 2020-09-30T03:41:50Z https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-for-a-multivalue-field/m-p/485063#M193520 <P>What is your suggested output?<BR /> Do you need your matching values as a new multivalue field? Or do you need the index of your matching values in your multivalue field?</P> <P>Maybe this can help you:</P> <PRE><CODE>| makeresults | eval mv="r_id1,r_id2,r_id3,r_id4" | makemv delim="," mv | eval result=mvfilter(match(mv,"r_id2") OR match(mv,"r_id3")) | eval n=if(isnotnull(mvfind(mv,"r_id2")),mvfind(mv,"r_id2"),""), n=if(isnotnull(mvfind(mv,"r_id3")),n.",".mvfind(mv,"r_id3"),"") </CODE></PRE> Mon, 20 Jan 2020 10:46:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-for-a-multivalue-field/m-p/485063#M193520 damann 2020-01-20T10:46:12Z https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-for-a-multivalue-field/m-p/485064#M193521 <P>Verify the required result:</P> <PRE><CODE>| makeresults count=2 | streamstats count | eval _time=if(count=2,relative_time(_time,"-2d@d"),relative_time(_time,"-1d@d")) | makecontinuous _time span=20m | eval user="user_".(random() % 9 + 1) | eval result_id="r_id".(random() % 4 + 1) | streamstats count | where count % 2 =1 | stats list(result_id) as result_id by user | rex field=result_id max_match=10 "(?&lt;result&gt;\w+(2|3))" </CODE></PRE> <P>Hi, folks</P> <PRE><CODE>How to write regex for a multivalue field? </CODE></PRE> <P><CODE>\w+(2|3)</CODE> , this regex is.</P> <P>recommend:</P> <PRE><CODE>query... |stats list(result_id) as result_id by user | rex field=result_id max_match=10 "(?&lt;result&gt;\w+(2|3))" </CODE></PRE> <P>How about this? </P> Mon, 20 Jan 2020 11:25:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-for-a-multivalue-field/m-p/485064#M193521 to4kawa 2020-01-20T11:25:23Z