Eval based on multivalue field and _time

[adamsmith47]

I have a set of results with _time, many single value fields, and a multivalue field which contains a large set of epoch values (mv_epoch). I want an eval to test if any of the mv_epoch values are between relative_time(_time, "-30d@d") and _time.

So something like:

....search results
| stats values(mv_epoch) AS mv_epoch values(field_a)... BY _time
| eval test=if((relative_time(_time, "-30d@d")<=mv_epoch AND mv_epoch<=_time),"yes","no")

Looking to solve this without using |mvexand.

Any help is greatly appreciated, thanks!

[bowesmana]

@adamsmith47 

if you don't want to do the mvexpand, then do the comparison before you do the aggregation

or, if you are using Splunk 8, you can use mvmap, see the last two lines of this example

| makeresults
| eval n=mvrange(1,4)
| mvexpand n
| eval _time = now() - (n * 1000)
| eval mv_epoch = mvrange(1,6)
| mvexpand mv_epoch
| eval mv_epoch = _time - (random() % 4 + 29) * 86400
| eval days=(_time-mv_epoch)/86400
| eval t=strftime(mv_epoch, "%F %T")
| stats values(mv_epoch) AS mv_epoch values(t) as t values(days) as days BY _time
| eval e=relative_time(_time, "-30d@d")
| eval test=if(isnull(mvmap(mv_epoch, if(e<=mv_epoch AND mv_epoch<=_time, 1, null()))),"no", "yes")