topic Re: How to match any value in an array to any value in another array? in Splunk Search

How to match any value in an array to any value in another array?

dtsao — Fri, 09 May 2025 18:43:44 GMT

I'm trying to do a transaction using an array. I need to define the transaction by a value in an array. However, this value could be any value in the array and the value could be in a different array index number in another event. Is there an easy command for this in Splunk?

Re: How to match any value in an array to any value in another array?

richgalloway — Sat, 10 May 2025 00:14:14 GMT

We need more information. Please say more about the problem you are trying to solve. It would help to see sample data and desired output.

Re: How to match any value in an array to any value in another array?

PickleRick — Sat, 10 May 2025 07:40:49 GMT

I second @richgalloway 's doubts - your description of the problem is confusing 🙂

Re: How to match any value in an array to any value in another array?

livehybrid — Sat, 10 May 2025 15:43:21 GMT

Hi @dtsao

I'm afraid you lost me at transaction - I dont think I've seen a good usecase for transaction for a number of years, where stats would be much better. The way I would approach this is to use something like foreach to loop through your array/multival field to set a fixed field with the value you are trying to transaction against. Once you've got this you should be able to do things with stats like | stats range(_time) as timeRange, count, etc BY yourField

If you're able to provide some sample data (redacted if needed) then I'd be happy to create a full query for you.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing