Remove field-value from multivalue

[siv]

I have  this table for example 

Field1 | Field2

Value1 | value1 value2 value3 

Field2 is mv

I want to remove the value that already axits in field1 so the result be like this:

Field1 | Field2

Value1 | value2, value3 

I didnt see the mvfilter support this

[livehybrid]

Hi @siv 

How about 

| makeresults
| eval Field1="value1", Field2="value1 value2 value3"
| eval Field2=split(Field2," ")
| foreach Field2 mode=multivalue [| eval Field2=mvappend(Field2,IF(<<ITEM>>!=Field1, <<ITEM>>,null()))]

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[PrewinThomas]

@siv 

You can consider using mvfilter as well.

| makeresults
| eval Field1="Value 1"
| eval Field2=split("Value 1,Value 2,Value 3", ",")
| eval Field2=mvfilter(match(Field2, "^(?!Value 1$).*"))

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[ITWhisperer]

| foreach mode=multivalue Field2
    [| eval new=if(<<ITEM>>!=Field1,mvappend(new,<<ITEM>>),new)]

[siv]

I think i tried that,

But i found a solution with mvmap and if match...

[bowesmana]

The simplest way is to use = rather than match, unless you need match. The problem with match is if your data contains anything that might be significant to the regular expression, e.g. if Value 1 is Va*ue, then that won't work well with match.

You can do it like this - example shows simple fields in Field1, 2 and 3 and then one with regex significant characters and shows Field6 works, but not Field7

| makeresults | fields - _time
| eval Field1="Value 1", Field2=split("Value 1,Value 2,Value 3", ",")
| eval Field3=mvmap(Field2, if(Field1=Field2, null(), Field2))
| eval Field4="Odd[Regex Chars?]Value 1", Field5=split("Odd[Regex Chars?]Value 1,Value 2,Value 3", ",")
| eval Field6_using_equals=mvmap(Field5, if(Field4=Field5, null(), Field5))
| eval Field7_using_match=mvmap(Field5, if(match(Field4,Field5), null(), Field5))