Splunk Search

How do I search for Filed Values in a Different Multi-Value Field

atebysandwich
Path Finder

I have two fields: DNS and DNS_Matched. The latter is a multi-value field. How can I see if a field value in DNS is in one  of the multi-value field in DNS_Matched?

Example:

DNSDNS_Matached
host1host1
host1-a
host1-r
host2host2
host2-a
host2-r
Labels (4)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the mvfind function.

| eval present=if(isnotnull(mvfind(DNS_Matched, DNS)),"yes", "no")

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

atebysandwich
Path Finder

This worked in a vacuum but I get an error saying it's expecting IN when I tried adding it to existing Eval statement

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share the existing eval statement so someone can figure out how to add mvfind.

---
If this reply helps you, Karma would be appreciated.
0 Karma

atebysandwich
Path Finder

Matched=if(match(DNS,Identified_Host_Formatted) OR match(DNS,DNS_Matched),1,0)

I Would like to add the search you created to this. These existing only work on single valued fields

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use mvfind in place of match for multi-value fields.

---
If this reply helps you, Karma would be appreciated.
0 Karma

atebysandwich
Path Finder

This didn't seem to work. I got error saying it could only use Boolean, or an error if around the if fucntion if I used isnotnull. Can you please type out waht you're thinking with the 3 clauses please?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This is what I'm thinking.

Matched=if(isnotnull(mvfind(DNS,Identified_Host_Formatted)) OR isnotnull(mvfind(DNS,DNS_Matched)),1,0)

If it doesn't work then please include the exact query you're testing in your reply.

---
If this reply helps you, Karma would be appreciated.
0 Karma

atebysandwich
Path Finder

The results were literally the same as my originally search. My search is not different now than what I used from yours.

0 Karma

atebysandwich
Path Finder

My requirements are, using mulit-values, if DNS is listed in DNS_Matched, have matched=1

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's time to stop the piecemeal business.  Please share the full (sanitized, if necessary) query that produces the current results and perhaps someone can find a way to produce the desired results.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...