Splunk Search

Filtering on specific multivalue field value

Path Finder

How do I return results based on a specific value of a multivalue field?

Example
returns all results where the 1st value of a multivalue field equals foo.

0 Karma

Builder

Expanding on @richgalloway's answer, you can do this:

index=ndx sourcetype=srctp mvfield="foo"
| where mvindex(mvfield,0)="foo"

Doing the mvfield="foo" in the first line of the search will throw-away all events where that individual value is not in the multivalue field.

Then the | where clause will further trim it

0 Karma

Champion

Hi @frbuser

Please try

| makeresults 
| eval test_column="test,cpu,foo,digit" 
| append 
    [| makeresults 
    | eval test_column="foo,one,two"] 
| makemv delim="," test_column 
| eval found=mvfind(test_column,"foo") 
| search found=0

Here found=0 when foo appears as first value

0 Karma

Path Finder

This requires adding a new field to every event. Is there anyway to do this via the initial search command?

The whole purpose is to retrieve the required events and doing it this way would require me to retrieve a larger subset first which is not very efficient in my case.

For some background, I am working with Windows event logs and I am filtering based on the Account_Name field. This field is however a multivalue field.

If I filter by any other criteria first, the query takes a long time to execute because there are so may logs to iterate through.

0 Karma

SplunkTrust
SplunkTrust

Something like | where mvindex(myField, 0)="foo" ?

---
If this reply helps you, an upvote would be appreciated.

Path Finder

This requires that you retrieve a subset of events first. Is there anyway to do this earlier within a search command?

Otherwise it makes the query less efficient because I have to retrieve a high volume of events then further filter it with "where".

0 Karma

SplunkTrust
SplunkTrust

It would help to see some sample events.

---
If this reply helps you, an upvote would be appreciated.
0 Karma