Archive

How to use mvfilter to get list of data that contain less and only less than the specific data?

Path Finder

Hi all,

I have a question related to my other question.

https://answers.splunk.com/answers/518074/how-to-get-a-count-of-stats-list-that-contains-a-s.html

Boundary: date and user. There are at least 1000 data. Sample example below.

Date User list(data)
3/31/17 user1 1, 2
3/31/17 user2 1, 5
3/31/17 user3 2, 10

Current search:
your current search giving Date User list(data)
| where isnotnull(mvfilter('list(data)'<3))
| chart count(user) by date

Let say I want to count user who have list(data) that contains number less and only less than "3". Then, the user count answer should be "1". Using the query above, I am getting result of "3". I tried adding "!> 2", but it won't run.

Eventually, I want to make side by side comparison between count(user) with list of data >3, and count of user with list of data less and only less than 3.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Do like this. Inverted the conditions. Basically you want to count events where list(data) only contains values < 3. For that, we try to find events where list(data) has values greater than 3, if it's null (no value is greater than 3) then it'll be counted.

your current search giving Date User list(data)
| where isnull(mvfilter('list(data)'>3))
| chart count(user) by date

View solution in original post

SplunkTrust
SplunkTrust

Do like this. Inverted the conditions. Basically you want to count events where list(data) only contains values < 3. For that, we try to find events where list(data) has values greater than 3, if it's null (no value is greater than 3) then it'll be counted.

your current search giving Date User list(data)
| where isnull(mvfilter('list(data)'>3))
| chart count(user) by date

View solution in original post

Path Finder

You are the best!
Where do you find documentation for isnull and isnotnull? Seriously couldn't find it.

0 Karma

SplunkTrust
SplunkTrust

Below link give details of all the functions that you can use with eval and where commands.

docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

0 Karma