Getting Data In

Filter results

rlautman
Path Finder

I have a search that returns a 2 multivalue fields, product and productstatus - I have used mvzip to combine the results of these fields into one, productandstatus - I want to filter these results in the search so that only certain rows are returned: for example

Multivalued field productandstatus - I would only want Type1, regardless of status, to be returned

Type1,acknowledged
Type1,cancelled
Type2,completed
Type4,cancelled

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

That sounds like a job for mvfilter() together with match(), probably looking for "^Type1,".

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

That sounds like a job for mvfilter() together with match(), probably looking for "^Type1,".

rlautman
Path Finder

Works like charm, thank you! 🙂

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Meet the .conf26 AI Agent Buildathon Winners

At the .conf26 AI Agent Buildathon, Splunk users turned their operational expertise into working AI agents ...

Trusted Autonomy in the SOC: A Maturity Journey

AI is compressing attacker timelines and pushing SOC teams beyond human capacity thresholds. The next SOC ...

Supercharging Windows Security Detection Performance: Introducing Hybrid Field ...

Windows event logs—from Security auditing and Sysmon to PowerShell script blocks—form the operational backbone ...