Splunk Search

How do I assign value to list or array and use it in where condition?

LearningGuy
Motivator

How do I assign value to list or array and use it in where condition?
Thank you in advance!!

For example:
I tried to search if number 4 is in array/list of number between 0 to 6.     

index = test
| eval   list-var = (0,1,2,3,4,5,6)
| eval num = 4
| search num IN list-var



Labels (1)
0 Karma

LearningGuy
Motivator

Hello, 
So, is multivalue the only way to use list/array?
If I want to assign 7 values, should I use mvappend 7 times like the following?

| eval test = mvappend("0", test)
| eval test = mvappend("1", test)
| eval test = mvappend("2", test)
| eval test = mvappend("3", test)
| eval test = mvappend("4", test)
| eval test = mvappend("5", test)
| eval test = mvappend("6", test)




How do I get true/false return if I want to see if number 5 is in the array/list?  
MVfind only give me the position of 5, which is 1.

| eval n = mvfind(test, "5")



Thank you

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You can "nest" mvappends to add multiple values at once. You can also use split() to make a multivalued field from a string of delimited values.

You can use isnull() to check if mvfind returned a value or not.

One caveat about mvfind though - it matches based on regex so you might get some unexpected results if you're not careful

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...