Getting Data In

Filter results

rlautman
Path Finder

I have a search that returns a 2 multivalue fields, product and productstatus - I have used mvzip to combine the results of these fields into one, productandstatus - I want to filter these results in the search so that only certain rows are returned: for example

Multivalued field productandstatus - I would only want Type1, regardless of status, to be returned

Type1,acknowledged
Type1,cancelled
Type2,completed
Type4,cancelled

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

That sounds like a job for mvfilter() together with match(), probably looking for "^Type1,".

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

That sounds like a job for mvfilter() together with match(), probably looking for "^Type1,".

rlautman
Path Finder

Works like charm, thank you! 🙂

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...