https://community.splunk.com/t5/Splunk-Search/How-to-use-variable-on-mvfilter-regex-match/m-p/690477#M235164 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/6367">@bowesmana</a>&nbsp;<BR /><BR />Your solution worked and you provided better example than Splunk documentation<BR />I appreciate your help. Thanks<BR /><BR />I thought I used one field on my mvfilter, which is fullcode...&nbsp; I guess partialcode is considered&nbsp; the second field..</P><PRE>| eval fullcode2=mvfilter(match(fullcode,partialcode))</PRE><P><BR /><BR /><BR /><BR /><BR /></P> Wed, 12 Jun 2024 14:10:02 GMT LearningGuy 2024-06-12T14:10:02Z https://community.splunk.com/t5/Splunk-Search/How-to-use-variable-on-mvfilter-regex-match/m-p/690406#M235146 <P><BR />If I used variable in the mvfilter match, i got the following error<BR /><SPAN>Error in 'EvalCommand': The arguments to the 'mvfilter' function are invalid.<BR /><BR /></SPAN>If I replaced the partialcode with a string, it worked fine<BR />Please help. Thank you so much</P><LI-CODE lang="markup">| makeresults | eval fullcode= "code-abc-1111,code-abc-2222,code-xyz-1111,code-xyz-222" | eval partialcode="code-abc" | makemv delim="," fullcode | eval fullcode2=mvfilter(match(fullcode,partialcode))</LI-CODE><P><BR />This one worked fine</P><LI-CODE lang="markup">| makeresults | eval fullcode= "code-abc-1111,code-abc-2222,code-xyz-1111,code-xyz-222" | eval partialcode="code-abc" | makemv delim="," fullcode | eval fullcode2=mvfilter(match(fullcode,"code-abc"))</LI-CODE><P><BR />&nbsp;</P> Wed, 12 Jun 2024 03:08:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-variable-on-mvfilter-regex-match/m-p/690406#M235146 LearningGuy 2024-06-12T03:08:13Z https://community.splunk.com/t5/Splunk-Search/How-to-use-variable-on-mvfilter-regex-match/m-p/690411#M235150 <P>mvfilter only takes a single field</P><P><A href="https://docs.splunk.com/Documentation/Splunk/9.2.0/SearchReference/MultivalueEvalFunctions#mvfilter.28.26lt.3Bpredicate.26gt.3B.29" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.2.0/SearchReference/MultivalueEvalFunctions#mvfilter.28.26lt.3Bpredicate.26gt.3B.29</A></P><P>Use mvmap instead</P><LI-CODE lang="markup">| makeresults | eval fullcode= "code-abc-1111,code-abc-2222,code-xyz-1111,code-xyz-222" | eval partialcode="code-abc" | makemv delim="," fullcode | eval fullcode2=mvmap(fullcode, if(match(fullcode,partialcode), fullcode, null()))</LI-CODE><P>&nbsp;</P> Wed, 12 Jun 2024 04:31:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-variable-on-mvfilter-regex-match/m-p/690411#M235150 bowesmana 2024-06-12T04:31:19Z https://community.splunk.com/t5/Splunk-Search/How-to-use-variable-on-mvfilter-regex-match/m-p/690477#M235164 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/6367">@bowesmana</a>&nbsp;<BR /><BR />Your solution worked and you provided better example than Splunk documentation<BR />I appreciate your help. Thanks<BR /><BR />I thought I used one field on my mvfilter, which is fullcode...&nbsp; I guess partialcode is considered&nbsp; the second field..</P><PRE>| eval fullcode2=mvfilter(match(fullcode,partialcode))</PRE><P><BR /><BR /><BR /><BR /><BR /></P> Wed, 12 Jun 2024 14:10:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-variable-on-mvfilter-regex-match/m-p/690477#M235164 LearningGuy 2024-06-12T14:10:02Z https://community.splunk.com/t5/Splunk-Search/How-to-use-variable-on-mvfilter-regex-match/m-p/690552#M235176 <P>You are right, partialcode is the second field - mvfilter has a few use cases, but I've generally found I'm always wanting to relate it to some other field, so when mvmap came along in Splunk 8, I almost never use mvfilter now - even when I could.</P> Wed, 12 Jun 2024 21:39:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-variable-on-mvfilter-regex-match/m-p/690552#M235176 bowesmana 2024-06-12T21:39:53Z