https://community.splunk.com/t5/Splunk-Search/How-to-extract-common-values-from-a-multi-value-field-for/m-p/599931#M208829 <LI-CODE lang="markup">| stats count by field_test | where count &gt; 1</LI-CODE> Tue, 31 May 2022 15:08:35 GMT ITWhisperer 2022-05-31T15:08:35Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-common-values-from-a-multi-value-field-for/m-p/599925#M208827 <P>Hi All,</P><P>I have a multi-value field as shown below-</P><TABLE border="1" width="100%"><TBODY><TR><TD width="59.29032258064516%" height="25px">_time&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</TD><TD width="40.70967741935484%" height="25px">field_test</TD></TR><TR><TD width="59.29032258064516%" height="25px"><SPAN>2022-05-13 04:36:00</SPAN></TD><TD width="40.70967741935484%" height="25px"><SPAN>test_data_1</SPAN></TD></TR><TR><TD width="59.29032258064516%" height="25px">&nbsp;</TD><TD width="40.70967741935484%" height="25px"><SPAN>test_data_2</SPAN></TD></TR><TR><TD width="59.29032258064516%" height="25px">&nbsp;</TD><TD width="40.70967741935484%" height="25px"><SPAN>test_data_3</SPAN></TD></TR><TR><TD width="59.29032258064516%" height="25px">&nbsp;</TD><TD width="40.70967741935484%" height="25px"><SPAN>test_data_4</SPAN></TD></TR><TR><TD width="59.29032258064516%" height="25px"><SPAN>2022-05-13 03:30:00&nbsp; &nbsp; </SPAN></TD><TD width="40.70967741935484%" height="25px"><SPAN>test_data_9</SPAN></TD></TR><TR><TD width="59.29032258064516%" height="25px">&nbsp;</TD><TD width="40.70967741935484%" height="25px"><SPAN>test_data_10</SPAN></TD></TR><TR><TD width="59.29032258064516%" height="25px">&nbsp;</TD><TD width="40.70967741935484%" height="25px"><SPAN>test_data_3</SPAN></TD></TR><TR><TD>&nbsp;</TD><TD><SPAN>test_data_4</SPAN><SPAN><BR /></SPAN></TD></TR></TBODY></TABLE><P>&nbsp;</P><P><SPAN>For the above two events, I am trying to write a query which can provide me the common values such that result is-</SPAN></P><TABLE border="1" width="100%"><TBODY><TR><TD width="100%">test_data_3</TD></TR><TR><TD width="100%">test_data_4</TD></TR></TBODY></TABLE><P><SPAN>&nbsp;</SPAN></P><P><SPAN>Please help me on how can I accomplish it?</SPAN></P><P>&nbsp;</P><P>&nbsp;</P> Tue, 31 May 2022 14:37:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-common-values-from-a-multi-value-field-for/m-p/599925#M208827 ashishdhinwa 2022-05-31T14:37:56Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-common-values-from-a-multi-value-field-for/m-p/599931#M208829 <LI-CODE lang="markup">| stats count by field_test | where count &gt; 1</LI-CODE> Tue, 31 May 2022 15:08:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-common-values-from-a-multi-value-field-for/m-p/599931#M208829 ITWhisperer 2022-05-31T15:08:35Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-common-values-from-a-multi-value-field-for/m-p/599960#M208842 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/246341">@ashishdhinwa</a>&nbsp;- You can try something like</P><LI-CODE lang="markup">&lt;your query&gt; | eventstats dc(_time) as total_count | mvexpand field_test | stats count, last(total_count) as total_count by field_test | where field_test&gt;=total_count | fields field_test</LI-CODE><P>This should provide values that are common for all the _time field values (present in all events).</P><P>&nbsp;</P><P>Hope this helps!!!</P> Tue, 31 May 2022 17:15:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-common-values-from-a-multi-value-field-for/m-p/599960#M208842 VatsalJagani 2022-05-31T17:15:41Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-common-values-from-a-multi-value-field-for/m-p/600864#M209153 <P>Thanks! This works <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 07 Jun 2022 13:11:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-common-values-from-a-multi-value-field-for/m-p/600864#M209153 ashishdhinwa 2022-06-07T13:11:15Z