topic Re: Removing some field values from a mulitiple value field in Splunk Search

Removing some field values from a mulitiple value field

youngrap — Tue, 03 Aug 2021 06:51:59 GMT

hello,

I want to remove the string in field_2 from field_1.
I want it to be like the value in the result field.

Like a list.remove() function in python.

field_1 : mulitiple values
field_2 : strings
result : mulitiple vlaues

I tried as below, but don't work.

try #1
| eval result=mvfilter(NOT match(field_1, field_2))

try #2
| eval result=field_1-field_2

thank you.

ITWhisperer — Tue, 03 Aug 2021 07:17:58 GMT

| eval result=mvmap(field_1,if(field_1!=field_2,field_1,null()))

youngrap — Tue, 03 Aug 2021 08:13:48 GMT

thank you!!! i solve it.