topic multivalue fields in Splunk Search

multivalue fields

poladbank — Sun, 16 Jan 2022 10:37:25 GMT

Hi I'm trying to count the number of times of a specific values "not match" exist in a multi-value field, search for events where this value appears more then once.

add an example

name	Check	ID
aaa-1 bbb-2 ccc-3	not match match match	6564
ddd-1 eee-2 fff-3	not match match not match	7875

because in the lower row the value "not match" exist more then 1 time (>1).
I don't found a suitable command.
would appreciate help:)

Re: multivalue fields

ITWhisperer — Sun, 16 Jan 2022 11:15:53 GMT

| chart values(name) as name count by ID Check | where 'count: not match' > 1 | rename "name: not match" as name, "count: not match" as count | table ID name count

Re: multivalue fields

poladbank — Sun, 16 Jan 2022 12:10:56 GMT

Thank you for your fast response!
I've tried your solution and had a problem in the where part.