Getting multivalued field values that are truncated by auto field extraction

[ken_t_huang]

Excuse me,
I have a data like this:
index=test, product=a, category="1";"3";"6",.....

how do I set the multi fields to search "3" "6"?
thanks!

[carasso · Accepted solution]

None of the mv/kv stuff works because the auto field extraction code stops interpreting category's value after the 2nd quote, so it looks like this:

    category="1"  ;"3";"6"

None of the multivalue suggestions by other users will work because the 'category' field only has a value of "1". You need to pullout the values yourself. You'll need to do something like this. It's a little ugly but totally doable...

 index=test product=a category (3 OR 6) |  rex "category=(?<catvals>\S+)" | rex max_match=1000 field=catvals "(?<mvcatvals>\d+)" | search mvcatvals=3 OR mvcatvals=6

I'll explain. First, search for events that have a 3 or 6. Then use 'rex' pull out the string values like "1";"3";"6", into the 'catvals' field. Then use 'rex' to pull out the numbers 1,3,6 into a multivalued field, 'mvcatvals'. Finally, filter on it mvcatvals for 3 OR 6.

You can play with things and see what's going on, by running this search in the ui.

| stats count | eval fakeraw = "foo category=\"1\";\"3\";\"6\" foo" | rex field=fakeraw "category=(?<catvals>\S+)" | rex max_match=1000 field=catvals "(?<mvcatvals>\d+)"

(the "|stats count" nonsense is just to make a dummy event with no data).

[torbael]

Try this one:

| makemv delim=";" category | mvexpand category | search category="3" OR category="6"

[ken_t_huang]

I have tried this, but it fail to search multi values, just show category="3" or "6"
I need to search all have 3 or 6.

[johandk]

Something like this might work:

| makemv delim=";" category | search category="\"3"\" category="\"6"\"