Splunk Enterprise Security

Substituting values from MV fields?

szabados
Communicator

In Enterprise Security, for a drill down action I want to use a field from the notable events, which can have multi valued fields as well.

In this case, if I simply do my_field_in_the_search=$myfield_in_the_notable$ in the drilldown search, the values are presented as follows:

my_field_in_the_search=value1,value2,value3

It cannot be used like this obviously, I would like to achieve something like

my_field_in_the_search=value1 OR my_field_in_the_search=value2, etc...

Is it possible to do this somehow?

0 Karma
1 Solution

DalJeanis
Legend

It seems a bit much to have to do, but this would work, as long as some value is selected...

Instead of ...

  index=foo my_field_in_the_search=$myfield_in_the_notable$ 

...you could code the search...

 index=foo [| makeresults |eval my_field_in_the_search=$myfield_in_the_notable$ | makemv delim="," my_field_in_the_search | mvexpand my_field_in_the_search | table my_field_in_the_search | format]

And the format command will turn it into ...

((my_field_in_the_search=value1) OR (my_field_in_the_search=value2)....)

View solution in original post

0 Karma

DalJeanis
Legend

It seems a bit much to have to do, but this would work, as long as some value is selected...

Instead of ...

  index=foo my_field_in_the_search=$myfield_in_the_notable$ 

...you could code the search...

 index=foo [| makeresults |eval my_field_in_the_search=$myfield_in_the_notable$ | makemv delim="," my_field_in_the_search | mvexpand my_field_in_the_search | table my_field_in_the_search | format]

And the format command will turn it into ...

((my_field_in_the_search=value1) OR (my_field_in_the_search=value2)....)
0 Karma

szabados
Communicator

This is great, thanks!

Get Updates on the Splunk Community!

Best Strategies to Optimize Observability Costs

 Join us on Tuesday, May 6, 2025, at 11 AM PDT / 2 PM EDT for an insightful session on optimizing ...

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...