Getting Data In

Filter results

rlautman
Path Finder

I have a search that returns a 2 multivalue fields, product and productstatus - I have used mvzip to combine the results of these fields into one, productandstatus - I want to filter these results in the search so that only certain rows are returned: for example

Multivalued field productandstatus - I would only want Type1, regardless of status, to be returned

Type1,acknowledged
Type1,cancelled
Type2,completed
Type4,cancelled

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

That sounds like a job for mvfilter() together with match(), probably looking for "^Type1,".

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

That sounds like a job for mvfilter() together with match(), probably looking for "^Type1,".

rlautman
Path Finder

Works like charm, thank you! 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...