How to mvfilter() the results of mvappend()?

woodams — Tue, 03 May 2022 16:00:31 GMT

I have several fields I want to lump into 1 multivalue field and remove blanks.

At the start of an event, there are up to 6 IP Addresses, either internal or external, but not both (they are the source IP, plus any LB hops along the way). They get extracted to either internal_src_ip# or external_src_ip#. If it is an internal IP, then the external_src_ip# will be "-", i.e. blank.

If I run

| eval OriginIP2 = mvappend(internal_src_ip, external_src_ip, internal_src_ip2, external_src_ip2, internal_src_ip3, external_src_ip3, internal_src_ip4, external_src_ip4, internal_src_ip5, external_src_ip5, internal_src_ip6, external_src_ip6 ) | eval OriginIP2 = mvfilter( match( OriginIP2, "^(?!-)" ) )

I get exactly what I want. A multivalue list in the field "OriginIP2" with "-" removed.

However putting it together in 1 line (to automate as a Calculated Field) gives me an error.

| eval OriginIP2 = mvfilter( match( mvappend(internal_src_ip, external_src_ip, internal_src_ip2, external_src_ip2, internal_src_ip3, external_src_ip3, internal_src_ip4, external_src_ip4, internal_src_ip5, external_src_ip5, internal_src_ip6, external_src_ip6 ), "^(?!-)") )

Error in 'eval' command: The arguments to the 'mvfilter' function are invalid.

As I read the docs, mvappend() should be returning a single mv field for match() to operate on, and then for match() to send to mvfilter().

What am I missing?

Re: mvfilter() the results of mvappend()

ITWhisperer — Tue, 03 May 2022 07:37:11 GMT

As the documentation says, mvfilter requires a reference to a mv-field (not a field), which is why your command throws an error. Try something like this:

| eval OriginIP2 = mvappend(if(internal_src_ip="-",null(),internal_src_ip), if(external_src_ip="-",null(),external_src_ip), if(internal_src_ip2="-",null(),internal_src_ip2), if(external_src_ip2="-",null(),external_src_ip2), if(internal_src_ip3="-",null(),internal_src_ip3),if(external_src_ip3="-",null(),external_src_ip3), if(internal_src_ip4="-",null(),internal_src_ip4), if(external_src_ip4="-",null(),external_src_ip4),if(internal_src_ip5="-",null(),internal_src_ip5), if(external_src_ip5="-",null(),external_src_ip5), if(internal_src_ip6="-",null(),internal_src_ip6), if(external_src_ip6="-",null(),external_src_ip6))

topic How to mvfilter() the results of mvappend()? in Splunk Search

How to mvfilter() the results of mvappend()?

Re: mvfilter() the results of mvappend()