Splunk Enterprise

How to exclude some keyword by using mvfilter?

super_saiyan
Communicator

Hi all, 

i want to hide / delete / exclude some keyword like " supersaiyan" , "leave" from the below event using mvfilter. can anyone please tell me how to do it ?

 

| makeresults
| eval target_text="My name is supersaiyan, leave this to me"

 

Thanks

 

Labels (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

when you have normal field (not multivalue) then you can do it like

| makeresults
| fields - _time
| eval target_text="My name is supersaiyan, leave this to me"
| rex mode=sed field=target_text "s/(supersaiyan|leave)//g"

r. Ismo 

super_saiyan
Communicator

thanks for your quick response @isoutamo .

This is for testing purpose, but i do have multi field values. could you please guide me how do this same thing using mvfilter.

 

Thanks

0 Karma

isoutamo
SplunkTrust
SplunkTrust
With mvfilter you can select items which contains that regex which you are looking. It's not remove those content like above rex.
https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/MultivalueEvalFunctions#mvfilter....
0 Karma

super_saiyan
Communicator

any thoughts ? @isoutamo 

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...