topic Re: How do I Search a Multi-Value Field? in Splunk Search

How do I Search a Multi-Value Field?

atebysandwich — Thu, 12 Oct 2023 16:30:21 GMT

I need to search a field called DNS_Matched, that has multi-value fields, for events that have one or more values that meet the criteria of the value ending with -admin, -vip, -mgt, or does not meet any of those three. How can I do that?

Example

DNS_Matched

host1
host1-vip
host1-mgt

host2
host2-admin
host2-mgmt
host2-vip

Re: How do I Search a Multi-Value Field?

richgalloway — Thu, 12 Oct 2023 17:00:58 GMT

To work with multi-value fields, look to the mv* functions.

| eval match=if(isnotnull(mvfind(DNS_Matched, "(-admin|-mgt|-vip)")),1, 0)

The mvfind function uses a regular expression to search an MV field for certain text. It returns NULL if the value is not found or an index into the field if it is found.

Re: How do I Search a Multi-Value Field?

atebysandwich — Thu, 12 Oct 2023 19:03:06 GMT

This helped a lot. Thank you!