Dashboards & Visualizations

How to filter multivalue of strings by substring/character?

Kubousky
Engager

I need to filter multivalue of strings by substring/character.

field coordinatorsID: a##1, b##2, c##3, d##3

field expertiseLevel can be one of  "1", "2", "3"

Exmple:

expertiseLevel = "3"

result ->  c##3, d##3

What I tried:

attempt1:

 | eval coordinatorsID_filtered = mvfilter(like(coordinatorsID,"%$expertiseLevel$"))            error

attempt2:

| eval expertiseLevel = case(expertiseLevel == "1", "%1", expertiseLevel == "2", "%2", expertiseLevel == "3", "%3")

 | eval coordinatorsID_filtered = mvfilter(like(coordinatorsID,$expertiseLevel$))                   null

 

Labels (1)
0 Karma

tshah-splunk
Splunk Employee
Splunk Employee

Hey @Kubousky,

If the field coordinatorsID is present as a column of the table, try expanding the field using mvexpand first, and then extract the field expertiseLevel from the coordinatorsID using regex. This will create a separate column for the expertiseLevel and then you can filter your data using the search command. Roughly your query should look something like this

<<your_base_query>>
| mvexpand coordinatorsID
| rex field=coordinatorsID "[a-zA-Z]##(?<expertiseLevel>\d)"
| search expertiseLevel="3"
---
If you find the answer helpful, an upvote/karma is appreciated
0 Karma
Get Updates on the Splunk Community!

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...