Dashboards & Visualizations

How to filter multivalue of strings by substring/character?


I need to filter multivalue of strings by substring/character.

field coordinatorsID: a##1, b##2, c##3, d##3

field expertiseLevel can be one of  "1", "2", "3"


expertiseLevel = "3"

result ->  c##3, d##3

What I tried:


 | eval coordinatorsID_filtered = mvfilter(like(coordinatorsID,"%$expertiseLevel$"))            error


| eval expertiseLevel = case(expertiseLevel == "1", "%1", expertiseLevel == "2", "%2", expertiseLevel == "3", "%3")

 | eval coordinatorsID_filtered = mvfilter(like(coordinatorsID,$expertiseLevel$))                   null


Labels (1)
0 Karma

Splunk Employee
Splunk Employee

Hey @Kubousky,

If the field coordinatorsID is present as a column of the table, try expanding the field using mvexpand first, and then extract the field expertiseLevel from the coordinatorsID using regex. This will create a separate column for the expertiseLevel and then you can filter your data using the search command. Roughly your query should look something like this

| mvexpand coordinatorsID
| rex field=coordinatorsID "[a-zA-Z]##(?<expertiseLevel>\d)"
| search expertiseLevel="3"
If you find the answer helpful, an upvote/karma is appreciated
0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...