Splunk Search

How do I search for Filed Values in a Different Multi-Value Field

atebysandwich
Path Finder

I have two fields: DNS and DNS_Matched. The latter is a multi-value field. How can I see if a field value in DNS is in one  of the multi-value field in DNS_Matched?

Example:

DNSDNS_Matached
host1host1
host1-a
host1-r
host2host2
host2-a
host2-r
Labels (4)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the mvfind function.

| eval present=if(isnotnull(mvfind(DNS_Matched, DNS)),"yes", "no")

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

atebysandwich
Path Finder

This worked in a vacuum but I get an error saying it's expecting IN when I tried adding it to existing Eval statement

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share the existing eval statement so someone can figure out how to add mvfind.

---
If this reply helps you, Karma would be appreciated.
0 Karma

atebysandwich
Path Finder

Matched=if(match(DNS,Identified_Host_Formatted) OR match(DNS,DNS_Matched),1,0)

I Would like to add the search you created to this. These existing only work on single valued fields

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use mvfind in place of match for multi-value fields.

---
If this reply helps you, Karma would be appreciated.
0 Karma

atebysandwich
Path Finder

This didn't seem to work. I got error saying it could only use Boolean, or an error if around the if fucntion if I used isnotnull. Can you please type out waht you're thinking with the 3 clauses please?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This is what I'm thinking.

Matched=if(isnotnull(mvfind(DNS,Identified_Host_Formatted)) OR isnotnull(mvfind(DNS,DNS_Matched)),1,0)

If it doesn't work then please include the exact query you're testing in your reply.

---
If this reply helps you, Karma would be appreciated.
0 Karma

atebysandwich
Path Finder

The results were literally the same as my originally search. My search is not different now than what I used from yours.

0 Karma

atebysandwich
Path Finder

My requirements are, using mulit-values, if DNS is listed in DNS_Matched, have matched=1

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's time to stop the piecemeal business.  Please share the full (sanitized, if necessary) query that produces the current results and perhaps someone can find a way to produce the desired results.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...