https://community.splunk.com/t5/Splunk-Search/Comparing-Multivalue-Fields/m-p/293296#M88542 <P>Exactly how I would have done it.</P> Fri, 18 Aug 2017 01:35:28 GMT woodcock 2017-08-18T01:35:28Z https://community.splunk.com/t5/Splunk-Search/Comparing-Multivalue-Fields/m-p/293294#M88540 <P>I have numerous events, each of which has a multivalue field that has a list of X (where X is a number) hashes in it. I want to do the equivalent of the Transaction command and group all the events that have the exact same list of X hashes in that multivalue field. If it has greater than X or less than X hashes in it, it doesnt belong in the group. Only group those events which have the exact same set of X hashes in the multivalue field.</P> Thu, 17 Aug 2017 18:21:59 GMT https://community.splunk.com/t5/Splunk-Search/Comparing-Multivalue-Fields/m-p/293294#M88540 msscott63 2017-08-17T18:21:59Z https://community.splunk.com/t5/Splunk-Search/Comparing-Multivalue-Fields/m-p/293295#M88541 <P>You can use nomv to turn the multivalue field into single value field, and then connect the different events using <CODE>transaction</CODE> or <CODE>stats</CODE> or any number of other methods.</P> <P>If the particular multiple hash values might be in a different order, then you probably want to sort them beforehand. </P> <PRE><CODE>| eval myflatfield=mvsort(mymvfield) | nomv myflatfield | stats values(*) as * by myflatfield </CODE></PRE> Thu, 17 Aug 2017 22:50:27 GMT https://community.splunk.com/t5/Splunk-Search/Comparing-Multivalue-Fields/m-p/293295#M88541 DalJeanis 2017-08-17T22:50:27Z https://community.splunk.com/t5/Splunk-Search/Comparing-Multivalue-Fields/m-p/293296#M88542 <P>Exactly how I would have done it.</P> Fri, 18 Aug 2017 01:35:28 GMT https://community.splunk.com/t5/Splunk-Search/Comparing-Multivalue-Fields/m-p/293296#M88542 woodcock 2017-08-18T01:35:28Z