Splunk Enterprise Security

match field value with multi-field value

N92
Path Finder

I have result in one field from the lookup and also result in second field(multivalue results) from lookup.

Accessed group = 1
Allowed group=1
=2

So if any value match with allowed group then it should not trigger.

0 Karma

gaurav_maniar
Builder

Append this to your query,

...| eval allowed = if(like(allowed_group, “%”.accessed_group.”%”), “yes”, “no”)

It will check, if values of accessed_group is present in allowed_group or not.

Accept the answer if it helps.

0 Karma
Get Updates on the Splunk Community!

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...