Expanding on @richgalloway's answer, you can do this:
index=ndx sourcetype=srctp mvfield="foo" | where mvindex(mvfield,0)="foo"
mvfield="foo" in the first line of the search will throw-away all events where that individual value is not in the multivalue field.
| where clause will further trim it
| makeresults | eval test_column="test,cpu,foo,digit" | append [| makeresults | eval test_column="foo,one,two"] | makemv delim="," test_column | eval found=mvfind(test_column,"foo") | search found=0
found=0 when foo appears as first value
This requires adding a new field to every event. Is there anyway to do this via the initial search command?
The whole purpose is to retrieve the required events and doing it this way would require me to retrieve a larger subset first which is not very efficient in my case.
For some background, I am working with Windows event logs and I am filtering based on the Account_Name field. This field is however a multivalue field.
If I filter by any other criteria first, the query takes a long time to execute because there are so may logs to iterate through.
This requires that you retrieve a subset of events first. Is there anyway to do this earlier within a search command?
Otherwise it makes the query less efficient because I have to retrieve a high volume of events then further filter it with "where".