https://community.splunk.com/t5/Splunk-Search/How-to-filter-a-multivalue-field-so-it-returns-results/m-p/299595#M90264 <P>Hello, thanks in advance for the help. I'd like to filter a multivalue field to where it will only return results that contain 3 or more values. This is in regards to email querying.</P> <P>I am trying to figure out when somebody's account has been phished, because when they are phished, the attacker keeps sending out gobs of spam to gmail and hotmail addresses.</P> <P>My fields are _time, sender, sender_domain, recipient, and message_subject</P> <P>The recipient field will have up to 100 recipients. I want it to only show results that have greater than 2 recipients, and the recipients have at least one @Anonymous.com address, or @hotmail.com address. Below is the search I use, but obviously needs work.</P> <PRE><CODE>sourcetype=MSExchange:2013:MessageTracking |dedup sender,recipient,message_subject, message_id |table _time sender sender_domain recipient recipient_domain message_subject |sort -_time | </CODE></PRE> Tue, 29 Sep 2020 14:06:35 GMT cm22486 2020-09-29T14:06:35Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-a-multivalue-field-so-it-returns-results/m-p/299595#M90264 <P>Hello, thanks in advance for the help. I'd like to filter a multivalue field to where it will only return results that contain 3 or more values. This is in regards to email querying.</P> <P>I am trying to figure out when somebody's account has been phished, because when they are phished, the attacker keeps sending out gobs of spam to gmail and hotmail addresses.</P> <P>My fields are _time, sender, sender_domain, recipient, and message_subject</P> <P>The recipient field will have up to 100 recipients. I want it to only show results that have greater than 2 recipients, and the recipients have at least one @Anonymous.com address, or @hotmail.com address. Below is the search I use, but obviously needs work.</P> <PRE><CODE>sourcetype=MSExchange:2013:MessageTracking |dedup sender,recipient,message_subject, message_id |table _time sender sender_domain recipient recipient_domain message_subject |sort -_time | </CODE></PRE> Tue, 29 Sep 2020 14:06:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-a-multivalue-field-so-it-returns-results/m-p/299595#M90264 cm22486 2020-09-29T14:06:35Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-a-multivalue-field-so-it-returns-results/m-p/299596#M90265 <P>Try like this (assuming field recipient is mulitivalued field. You may not need the makemv command)<BR /> <STRONG>Updated</STRONG></P> <PRE><CODE>sourcetype=MSExchange:2013:MessageTracking |dedup sender,recipient,message_subject, message_id |table _time sender sender_domain recipient recipient_domain message_subject | makemv recipient | where mvcount(recipient)&gt;2 AND (isnotnull(mvfind(recipient,"\.gmail\.com")) OR isnotnull(mvfind(recipient,"\.hotmail\.com"))) </CODE></PRE> Wed, 17 May 2017 18:46:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-a-multivalue-field-so-it-returns-results/m-p/299596#M90265 somesoni2 2017-05-17T18:46:03Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-a-multivalue-field-so-it-returns-results/m-p/299597#M90266 <PRE><CODE>| where mvcount (mvfilter (match (recipient,"\.gmail\.com") OR match (recipient,"\.hotmail\.com") ) )&gt;2 </CODE></PRE> <HR /> <P>updated to add one more close parenthesis.</P> Wed, 17 May 2017 19:18:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-a-multivalue-field-so-it-returns-results/m-p/299597#M90266 DalJeanis 2017-05-17T19:18:00Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-a-multivalue-field-so-it-returns-results/m-p/299598#M90267 <P>Error in 'where' command: The expression is malformed. Expected ).</P> Wed, 17 May 2017 19:19:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-a-multivalue-field-so-it-returns-results/m-p/299598#M90267 cm22486 2017-05-17T19:19:19Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-a-multivalue-field-so-it-returns-results/m-p/299599#M90268 <P>"Error in 'where' command: The arguments to the 'mvfind' function are invalid."</P> Wed, 17 May 2017 19:19:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-a-multivalue-field-so-it-returns-results/m-p/299599#M90268 cm22486 2017-05-17T19:19:34Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-a-multivalue-field-so-it-returns-results/m-p/299600#M90269 <P>Try the updated answer.</P> Wed, 17 May 2017 19:23:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-a-multivalue-field-so-it-returns-results/m-p/299600#M90269 somesoni2 2017-05-17T19:23:27Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-a-multivalue-field-so-it-returns-results/m-p/299601#M90270 <P>That did it! Thanks!</P> Wed, 17 May 2017 19:34:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-a-multivalue-field-so-it-returns-results/m-p/299601#M90270 cm22486 2017-05-17T19:34:54Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-a-multivalue-field-so-it-returns-results/m-p/299602#M90271 <P>Like this:</P> <PRE><CODE>sourcetype=MSExchange:2013:MessageTracking |dedup sender,recipient,message_subject, message_id | where mvcount(recipient) &gt;= 3 AND isnotnull(mvfilter(match(recipient, "@(?:gmail|hotmail)\.com$"))) | table _time sender sender_domain recipient recipient_domain message_subject </CODE></PRE> Wed, 17 May 2017 20:18:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-a-multivalue-field-so-it-returns-results/m-p/299602#M90271 woodcock 2017-05-17T20:18:14Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-a-multivalue-field-so-it-returns-results/m-p/299603#M90272 <P>Added one close paren.</P> Wed, 17 May 2017 23:53:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-a-multivalue-field-so-it-returns-results/m-p/299603#M90272 DalJeanis 2017-05-17T23:53:52Z