topic Re: Search for events that have only specific multiple values in a field in Splunk Search

Search for events that have only specific multiple values in a field

RowdyRodney — Tue, 29 Apr 2025 02:53:12 GMT

Hey all - I have a need to search for events in Splunk that contain two specific values in one field. I want the results to return only those events that have both values in them. I'm trying to use this:

(my_field_name="value1" AND my_field_name="value2")

This still returns results that have either value1, or value2, not events that contain both. How would I query for results that contain only both values, not individual values?

Re: Search for events that have only specific multiple values in a field

bowesmana — Tue, 29 Apr 2025 03:58:16 GMT

That doesn't sound right - are you referring to a multi-value field?

| makeresults | fields - _time | eval value=split("ABC","") | search value=A AND value=C

This search above will find a result for A and C, but if you change it to A and D it does not find results.

Can you give an example of your results in the OR case

Re: Search for events that have only specific multiple values in a field

ITWhisperer — Tue, 29 Apr 2025 07:09:50 GMT

If you want for value to contain only those two values, you could modify @bowesmana 's solution like so