topic How to filter a multivalue field using a subsearch? in Splunk Search

How to filter a multivalue field using a subsearch?

chrids — Fri, 01 Apr 2022 18:47:50 GMT

I found a close answer to what I'm looking for here:

https://community.splunk.com/t5/Splunk-Search/Why-cant-i-supply-a-field-as-value-for-mvfilter/m-p/450564/highlight/true#M127583

The example, excludes 1 example, add \"a\" for more, which works:

| makeresults 
| eval mymvfield ="a b c" 
| makemv mymvfield 
| eval excludes = mvfilter(NOT in(mymvfield, 
    [| makeresults 
    | eval search = "\"b\"" 
    | return $search]))

What I'm looking for, use return which seemingly translates to (b) OR (a) ... :

| makeresults 
| eval mymvfield ="a b c" 
| makemv mymvfield 
| eval excludes = mvfilter(NOT in(mymvfield, 
    [| search something
    | return 3 $some_field]))

I get weird parsing errors which I thought maybe could be solved by using "format" but I'm at a loss.

I reckon you could probably solve this by doing a subsearch and filtering prior to making the multivalue field, I'm however curious if you can make this query work.

Please let me know if anything is unclear.

Re: How to filter a multivalue field using a subsearch?

ITWhisperer — Sat, 02 Apr 2022 08:38:57 GMT

Try something like this

Re: How to filter a multivalue field using a subsearch?

chrids — Mon, 04 Apr 2022 04:41:47 GMT

It's almost there, I can't manage to replace the two "| makeresults/| append" with a "| search" however in the final query.

This:

evaluates to:

mymvfield="b" AND mymvfield="c"

My reduced use-case:

evaluates to:

bar="result1" AND bar="result2"

Wrapping that into mvfilter(NOT [ .. ]) gives me: Error in 'eval' command: The expression is malformed.

Re: How to filter a multivalue field using a subsearch?

ITWhisperer — Mon, 04 Apr 2022 07:30:30 GMT

Please share your actual search to determine what might be amiss

Re: How to filter a multivalue field using a subsearch?

chrids — Mon, 04 Apr 2022 10:14:02 GMT

Got it working! Thanks so much!

I had a syntax error and changed it to a final: