Dashboards & Visualizations

How to filter multivalue of strings by substring/character?

Kubousky
Engager

I need to filter multivalue of strings by substring/character.

field coordinatorsID: a##1, b##2, c##3, d##3

field expertiseLevel can be one of  "1", "2", "3"

Exmple:

expertiseLevel = "3"

result ->  c##3, d##3

What I tried:

attempt1:

 | eval coordinatorsID_filtered = mvfilter(like(coordinatorsID,"%$expertiseLevel$"))            error

attempt2:

| eval expertiseLevel = case(expertiseLevel == "1", "%1", expertiseLevel == "2", "%2", expertiseLevel == "3", "%3")

 | eval coordinatorsID_filtered = mvfilter(like(coordinatorsID,$expertiseLevel$))                   null

 

Labels (1)
0 Karma

tshah-splunk
Splunk Employee
Splunk Employee

Hey @Kubousky,

If the field coordinatorsID is present as a column of the table, try expanding the field using mvexpand first, and then extract the field expertiseLevel from the coordinatorsID using regex. This will create a separate column for the expertiseLevel and then you can filter your data using the search command. Roughly your query should look something like this

<<your_base_query>>
| mvexpand coordinatorsID
| rex field=coordinatorsID "[a-zA-Z]##(?<expertiseLevel>\d)"
| search expertiseLevel="3"
---
If you find the answer helpful, an upvote/karma is appreciated
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...