https://community.splunk.com/t5/Splunk-Search/using-mvfind-for-an-eventtype/m-p/20414#M3183 <P>I'm not sure what the deal is with mvfind, but would this work?:</P> <PRE><CODE>search X | eval a=mvfilter(eventtype LIKE "network_%") | search a=* | timechart count by a </CODE></PRE> Wed, 01 Jun 2011 01:53:28 GMT mw 2011-06-01T01:53:28Z https://community.splunk.com/t5/Splunk-Search/using-mvfind-for-an-eventtype/m-p/20413#M3182 <P>i have numerous eventtypes defined and in many cases a logging event may have several eventtypes associated with it.</P> <P>i would like to be able to plot the eventtypes such that i do not get duplicates in the chart/pie chart. for example, i may have a log entry with eventtype=cisco_syslog_types and eventtype=network_port (ie it's a multivariable field)</P> <P>i understand that there is a 'mvfind()' command where i could potentially do something like</P> <PRE><CODE>search X | eval mvfind( eventtype, "network_*" ) </CODE></PRE> <P>but it returns that the 'mvfind' function is unsupported. i'm using splunk 4.2.1.</P> <P>i've also tried using the mvindex() command with success, however, as the order of the eventtype mv is never the same, its usefulness is somewhat limited.</P> Mon, 28 Sep 2020 09:38:06 GMT https://community.splunk.com/t5/Splunk-Search/using-mvfind-for-an-eventtype/m-p/20413#M3182 ytl 2020-09-28T09:38:06Z https://community.splunk.com/t5/Splunk-Search/using-mvfind-for-an-eventtype/m-p/20414#M3183 <P>I'm not sure what the deal is with mvfind, but would this work?:</P> <PRE><CODE>search X | eval a=mvfilter(eventtype LIKE "network_%") | search a=* | timechart count by a </CODE></PRE> Wed, 01 Jun 2011 01:53:28 GMT https://community.splunk.com/t5/Splunk-Search/using-mvfind-for-an-eventtype/m-p/20414#M3183 mw 2011-06-01T01:53:28Z https://community.splunk.com/t5/Splunk-Search/using-mvfind-for-an-eventtype/m-p/20415#M3184 <P>cool; that worked! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> is there a way to do a 'NOT' in the like? specifically, i have single events with both eventtypes network_acl and network_acl.deny and i only care to count the ones without the '.' in the eventtype. cheers!</P> Mon, 28 Sep 2020 09:38:37 GMT https://community.splunk.com/t5/Splunk-Search/using-mvfind-for-an-eventtype/m-p/20415#M3184 ytl 2020-09-28T09:38:37Z https://community.splunk.com/t5/Splunk-Search/using-mvfind-for-an-eventtype/m-p/20416#M3185 <P>Strangely, I don't think you can literally do: mvfilter(eventtype NOT LIKE ".."). I believe you have to switch syntax. Something like (this uses regular expressions, rather than %): <STRONG>eval a=mvfilter(NOT match(eventtype, "\..*$")) | search a=*</STRONG></P> Sun, 05 Jun 2011 15:52:33 GMT https://community.splunk.com/t5/Splunk-Search/using-mvfind-for-an-eventtype/m-p/20416#M3185 mw 2011-06-05T15:52:33Z https://community.splunk.com/t5/Splunk-Search/using-mvfind-for-an-eventtype/m-p/20417#M3186 <P>To be clear, you can use mvfilter(match(...)) and mvfilter(NOT match(...)), mvfilter(like(...)), etc</P> Sun, 05 Jun 2011 16:23:51 GMT https://community.splunk.com/t5/Splunk-Search/using-mvfind-for-an-eventtype/m-p/20417#M3186 mw 2011-06-05T16:23:51Z https://community.splunk.com/t5/Splunk-Search/using-mvfind-for-an-eventtype/m-p/20418#M3187 <P>mvfind is only available from 4.2.2 - <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions</A></P> Fri, 03 Aug 2012 13:43:23 GMT https://community.splunk.com/t5/Splunk-Search/using-mvfind-for-an-eventtype/m-p/20418#M3187 brettcave 2012-08-03T13:43:23Z