Splunk Search

How do I exclude fields with certain values from a table when the event has multiple values for the same fields?

ZacEsa
Communicator

Hi,

As the title says. Refer to the screenshot below too;

The event
The above is the log for the event. as you can see, there are multiple indicatorName in a single event.

The table
And this is the table when I do a top. However, I only want certain values to show. E.g. Only show indicatorName: DETECTED_MALWARE_APP and not indicatorName: CODE_DROP.

0 Karma
1 Solution

DalJeanis
Legend

If you are trying to eliminate just the words from the multivalue field, then use mvfilter().

| eval Indicator=mvfilter(NOT match(Indicator,"^(POLICY_TERMINATE|MALWARE_DROP)$"))

The doc is on this page...

http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/MultivalueEvalFunctions

And here are a couple of related answers...

https://answers.splunk.com/answers/13382/removing-some-field-values-from-a-mulitiple-value-field.htm...

https://answers.splunk.com/answers/346961/remove-multiple-values-from-a-multi-value-field.html

View solution in original post

DalJeanis
Legend

If you are trying to eliminate just the words from the multivalue field, then use mvfilter().

| eval Indicator=mvfilter(NOT match(Indicator,"^(POLICY_TERMINATE|MALWARE_DROP)$"))

The doc is on this page...

http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/MultivalueEvalFunctions

And here are a couple of related answers...

https://answers.splunk.com/answers/13382/removing-some-field-values-from-a-mulitiple-value-field.htm...

https://answers.splunk.com/answers/346961/remove-multiple-values-from-a-multi-value-field.html

ZacEsa
Communicator

I tried it with eval threatInfo.indicators{}.indicatorName=mvfilter(match(threatInfo.indicators{}.indicatorName, "DETECTED_MALWARE_APP")) but it's throwing Error in 'eval' command: The expression is malformed. Expected ).

0 Karma

ZacEsa
Communicator

Nevermind, found out the issue. Splunk doesn't like it when my field name is threatInfo.indicators{}.indicatorName. Had to rename it to something else and then it worked. Thank you! Will mark your answer as correct now.

0 Karma
Get Updates on the Splunk Community!

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Automatic Discovery Part 2: Setup and Best Practices

In Part 1 of this series, we covered what Automatic Discovery is and why it’s critical for observability at ...