https://community.splunk.com/t5/Splunk-Search/How-to-Pull-specific-value-from-MV-field/m-p/602495#M209720 <P>Also I would want to set a default value if a record does not contain that "sn_ubs" entry</P> Mon, 20 Jun 2022 22:36:50 GMT morgantay96 2022-06-20T22:36:50Z https://community.splunk.com/t5/Splunk-Search/How-to-Pull-specific-value-from-MV-field/m-p/602494#M209719 <P>Hi All,</P> <P>I have a mv field with a bunch of different values. I want to learn how to pull specific values based on string criteria. For examle the multivalue field may contain<BR /><BR />"App: A;&nbsp; sn_ubs;&nbsp; Owner_Bob; Criticality_3;"<BR /><BR />How would I create an eval to pull just the "sn_ubs" into a new field name SN?<BR /><BR />I am unsure of what manipulation does this. I have tried mvfilter and that works but doesn't break out the value.</P> Tue, 21 Jun 2022 21:00:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Pull-specific-value-from-MV-field/m-p/602494#M209719 morgantay96 2022-06-21T21:00:39Z https://community.splunk.com/t5/Splunk-Search/How-to-Pull-specific-value-from-MV-field/m-p/602495#M209720 <P>Also I would want to set a default value if a record does not contain that "sn_ubs" entry</P> Mon, 20 Jun 2022 22:36:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Pull-specific-value-from-MV-field/m-p/602495#M209720 morgantay96 2022-06-20T22:36:50Z https://community.splunk.com/t5/Splunk-Search/How-to-Pull-specific-value-from-MV-field/m-p/602496#M209721 <P>If anyone has this issue I figured it out.</P><P><BR />Just ensure your field is multivalue then use mvfilter</P><P>| eval [new_field] = mvfilter(match([old mv field], "[string to match]"))</P> Mon, 20 Jun 2022 22:42:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Pull-specific-value-from-MV-field/m-p/602496#M209721 morgantay96 2022-06-20T22:42:00Z