topic Re: How do I assign value to list or array and use it in where condition? in Splunk Search

How do I assign value to list or array and use it in where condition?

LearningGuy — Tue, 19 Mar 2024 20:14:44 GMT

How do I assign value to list or array and use it in where condition?
Thank you in advance!!

For example:
I tried to search if number 4 is in array/list of number between 0 to 6.

index = test | eval list-var = (0,1,2,3,4,5,6) | eval num = 4 | search num IN list-var

Re: How do I assign value to list or array and use it in where condition?

PickleRick — Tue, 19 Mar 2024 21:28:33 GMT

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/MultivalueEvalFunctions#mvfind.28.26lt.3Bmv.26gt.3B.2C.26lt.3Bregex.26gt.3B.29

Re: How do I assign value to list or array and use it in where condition?

LearningGuy — Tue, 19 Mar 2024 22:02:11 GMT

Hello,
So, is multivalue the only way to use list/array?
If I want to assign 7 values, should I use mvappend 7 times like the following?

How do I get true/false return if I want to see if number 5 is in the array/list?
MVfind only give me the position of 5, which is 1.

| eval n = mvfind(test, "5")

Thank you

Re: How do I assign value to list or array and use it in where condition?

PickleRick — Tue, 19 Mar 2024 22:04:46 GMT

You can "nest" mvappends to add multiple values at once. You can also use split() to make a multivalued field from a string of delimited values.

You can use isnull() to check if mvfind returned a value or not.

One caveat about mvfind though - it matches based on regex so you might get some unexpected results if you're not careful