Hello,
I am wondering what the best way to find a value in one my fields matches what is in a mv field. I cannot use mv expand and a where due to the storage limit I encounter. Is there a way to show that "match" matches with the values in field2, but "miss" would not.
Try where like. It can compare with any value inside the mv field.
| where field1 LIKE (field2)
Try mvfind
| eval found = mvfind(field2, field1)