topic How do a search with a string comma separated values ? in Splunk Search

How do a search with a string comma separated values ?

JuanAntunes — Mon, 20 Sep 2021 15:25:41 GMT

Hello team! How are u?

I have a question about how to search with a comma separated values:

Example:

I have an index with vm's information, like this:

JuanAntunes_2-1632151288903.png

In the column "datastores" returns me all datastores assigned to this VM, so I need to calculate how much freespace I have in this VM.

So I have another index, with the "datastores" information, like this:

JuanAntunes_3-1632151303605.png

I know how to filter just one result, but I don't know how I can filter two or more comma-separated datastores.

Can anyone help me? Thanks in advanced

Re: How do a search with a string comma separated values ?

ashvinpandey — Mon, 20 Sep 2021 15:33:07 GMT

@JuanAntunes First split the values of your datastore field as a seperate row then search for it, like below:

| eval datastores=split(datastores,",") | mvexpand datastores | search datastores="*"

Also, If this reply helps you, an upvote would be appreciated.

Re: How do a search with a string comma separated values ?

JuanAntunes — Mon, 20 Sep 2021 15:40:31 GMT

Hi @ashvinpandey , first of all thanks for your time!

Here's the query I'm doing with your help, but still to no success.

JuanAntunes_0-1632152373077.png

Thanks again!

Re: How do a search with a string comma separated values ?

ashvinpandey — Mon, 20 Sep 2021 15:46:25 GMT

@JuanAntunes Make sure your subsearch is also having the same datastores field name also the datastores field in the subsearch is also splitted if it contains "," and add below query line after your eval tmp:

| fields tmp

Re: How do a search with a string comma separated values ?

JuanAntunes — Mon, 20 Sep 2021 15:59:41 GMT

Thanks so much! @ashvinpandey it works!