How to Filter out rows when multivalues are present

[cindygibbs_08]

Hello everyone I hope you guys are doing just great!

I have a sort of simple question but I have not been able to come up with a solution.. I want to be able to filter out rows of a table where there are multivalues based a numeric criteria, this is an example:

I have this:

AGENT	INX	ROCKS	TASK
XX_9	7 9 -6	T Y U	TY-8 GY-0 FG-67
XX_10	7 -49 -66	UY IO UJI	TY-8E G-0 VG-67

I would like to only remove all rows in the table where  the multivalue field "INX" have negative numbers and have something like this:

AGENT	INX	ROCKS	TASK
XX_9	7 9	T Y	TY-8 GY-0
XX_10	7	UY	TY-8E

I have tried using mvfilter and mvfind and mvindex but... every trial has not been successful yet so I really love you guys for helping me out thanks a LOTTTT

kindly,

Cindy

[kamlesh_vaghela]

@cindygibbs_08 
Glad to help you. You suppose to accept one of my answer.  🙂

[kamlesh_vaghela · Accepted solution]

@cindygibbs_08 

Can you please try this?

YOUR_SEARCH
| eval t=mvzip(mvzip(INX,ROCKS),TASK)
| stats count by AGENT,t
| eval INX= mvindex(split(t,","),0), ROCKS=mvindex(split(t,","),1), TASK=mvindex(split(t,","),2)
| where INX > 0

| stats list(INX) as INX list(ROCKS) as ROCKS list(TASK) as TASK by AGENT

My Sample Search :

| makeresults | eval _raw="AGENT	INX	ROCKS	TASK
XX_9	7|9|-6	T|Y|U	TY-8|GY-0|FG-67
XX_10	7|-49|-66	UY|IO|UJI	TY-8E|G-0|VG-67
" | multikv forceheader=1 | eval INX=split(INX,"|"), ROCKS=split(ROCKS,"|"), TASK=split(TASK,"|")
| rename comment as "Upto Now is sample data only"
| eval t=mvzip(mvzip(INX,ROCKS),TASK)
| stats count by AGENT,t
| eval INX= mvindex(split(t,","),0), ROCKS=mvindex(split(t,","),1), TASK=mvindex(split(t,","),2)
| where INX > 0

| stats list(INX) as INX list(ROCKS) as ROCKS list(TASK) as TASK by AGENT

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

[cindygibbs_08]

Hello @kamlesh_vaghela  thank you so much for your help, I have one final question... would this example still stand for multiple cases... not just this particular one but for all that are like this... moreover does the mvzip function truncate after a number of statistics?

[kamlesh_vaghela]

@cindygibbs_08 

Yes, the sample example will work with similar use cases also. 

mvzip used for combining two multivalued fields and no truncation I have faced ever with mvzip. 🙂 

https://docs.splunk.com/Documentation/SCS/current/SearchReference/MultivalueEvalFunctions#mvzip.28.2...

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.