topic Re: How do I search for Filed Values in a Different Multi-Value Field in Splunk Search

How do I search for Filed Values in a Different Multi-Value Field

atebysandwich — Fri, 13 Oct 2023 16:02:42 GMT

I have two fields: DNS and DNS_Matched. The latter is a multi-value field. How can I see if a field value in DNS is in one of the multi-value field in DNS_Matched?

Example:

DNS	DNS_Matached
host1	host1 host1-a host1-r
host2	host2 host2-a host2-r

Re: How do I search for Filed Values in a Different Multi-Value Field

richgalloway — Fri, 13 Oct 2023 16:38:42 GMT

Use the mvfind function.

| eval present=if(isnotnull(mvfind(DNS_Matched, DNS)),"yes", "no")

Re: How do I search for Filed Values in a Different Multi-Value Field

atebysandwich — Fri, 13 Oct 2023 17:52:55 GMT

This worked in a vacuum but I get an error saying it's expecting IN when I tried adding it to existing Eval statement

Re: How do I search for Filed Values in a Different Multi-Value Field

richgalloway — Fri, 13 Oct 2023 18:16:27 GMT

Please share the existing eval statement so someone can figure out how to add mvfind.

Re: How do I search for Filed Values in a Different Multi-Value Field

atebysandwich — Fri, 13 Oct 2023 18:30:03 GMT

Matched=if(match(DNS,Identified_Host_Formatted) OR match(DNS,DNS_Matched),1,0)

I Would like to add the search you created to this. These existing only work on single valued fields

Re: How do I search for Filed Values in a Different Multi-Value Field

richgalloway — Fri, 13 Oct 2023 18:55:22 GMT

Use mvfind in place of match for multi-value fields.

Re: How do I search for Filed Values in a Different Multi-Value Field

atebysandwich — Mon, 16 Oct 2023 15:37:34 GMT

This didn't seem to work. I got error saying it could only use Boolean, or an error if around the if fucntion if I used isnotnull. Can you please type out waht you're thinking with the 3 clauses please?

Re: How do I search for Filed Values in a Different Multi-Value Field

richgalloway — Mon, 16 Oct 2023 15:41:31 GMT

This is what I'm thinking.

Matched=if(isnotnull(mvfind(DNS,Identified_Host_Formatted)) OR isnotnull(mvfind(DNS,DNS_Matched)),1,0)

If it doesn't work then please include the exact query you're testing in your reply.

Re: How do I search for Filed Values in a Different Multi-Value Field

atebysandwich — Mon, 16 Oct 2023 16:46:25 GMT

The results were literally the same as my originally search. My search is not different now than what I used from yours.

Re: How do I search for Filed Values in a Different Multi-Value Field

atebysandwich — Mon, 16 Oct 2023 16:47:42 GMT

My requirements are, using mulit-values, if DNS is listed in DNS_Matched, have matched=1

Re: How do I search for Filed Values in a Different Multi-Value Field

richgalloway — Mon, 16 Oct 2023 17:37:51 GMT

It's time to stop the piecemeal business. Please share the full (sanitized, if necessary) query that produces the current results and perhaps someone can find a way to produce the desired results.