topic How to edit my search to return events where Field2 has both values 'foo' AND 'bar' in multivalue Field1? in Splunk Search

How to edit my search to return events where Field2 has both values 'foo' AND 'bar' in multivalue Field1?

jwalzerpitt — Tue, 23 Feb 2016 16:20:56 GMT

I have events in which Field1 contains multiple values, but I only need to look for two values (foo AND bar) and tie them to Field2. What's the most efficient way to craft this search?

I'm basically looking for events to be returned in which Field2 has both 'foo' AND 'bar' in Field1.

Thx

Re: How to edit my search to return events where Field2 has both values 'foo' AND 'bar' in multivalue Field1?

jwalzerpitt — Tue, 23 Feb 2016 16:53:18 GMT

I do have the following query:

index=indexname Field1=foo OR Field1=bar | stats values(Field1), dc(Field1) by Field2

But if I change the 'OR' to 'AND' it kills the query

Thx

Re: How to edit my search to return events where Field2 has both values 'foo' AND 'bar' in multivalue Field1?

jplumsdaine22 — Tue, 23 Feb 2016 17:43:56 GMT

I'm guessing that field1 in its original context is not a multivalue field. So what you need is an additional search command after your stats command.

index=indexname Field1=foo OR Field1=bar | stats values(Field1), dc(Field1) by Field2 | search (Field1=foo AND Field1=bar)

Re: How to edit my search to return events where Field2 has both values 'foo' AND 'bar' in multivalue Field1?

jwalzerpitt — Tue, 23 Feb 2016 18:04:54 GMT

Thx for the reply - actually Field1 is the multivalue field (it has seven total values, but I'm only looking to pull two)

Re: How to edit my search to return events where Field2 has both values 'foo' AND 'bar' in multivalue Field1?

jwalzerpitt — Tue, 23 Feb 2016 18:09:41 GMT

And i just realized one flaw in my logic in that Field1 will always be an 'OR' as the even though Field2 can have one of the two Field1 values, it will be one value per event. Field2 will never have 'foo' and 'bar' in the same event.

Re: How to edit my search to return events where Field2 has both values 'foo' AND 'bar' in multivalue Field1?

jwalzerpitt — Wed, 24 Feb 2016 14:42:30 GMT

I've been running the following query below and I believe I'm getting the results I need. Would be interested to see if someone could runt he same query and check if they're getting the results they'd expect as well.

index=indexname Field1=foo OR Field1=bar | stats values(Field1), dc(Field1) as Total by Field2 | where Total >=2

Thx