How do I search for Filed Values in a Different Multi-Value Field

[atebysandwich]

I have two fields: DNS and DNS_Matched. The latter is a multi-value field. How can I see if a field value in DNS is in one  of the multi-value field in DNS_Matched?

Example:

DNS	DNS_Matached
host1	host1 host1-a host1-r
host2	host2 host2-a host2-r

[richgalloway]

Use the mvfind function.

| eval present=if(isnotnull(mvfind(DNS_Matched, DNS)),"yes", "no")

[atebysandwich]

This worked in a vacuum but I get an error saying it's expecting IN when I tried adding it to existing Eval statement

[richgalloway]

Please share the existing eval statement so someone can figure out how to add mvfind.

[atebysandwich]

Matched=if(match(DNS,Identified_Host_Formatted) OR match(DNS,DNS_Matched),1,0)

I Would like to add the search you created to this. These existing only work on single valued fields

[richgalloway]

Use mvfind in place of match for multi-value fields.

[atebysandwich]

This didn't seem to work. I got error saying it could only use Boolean, or an error if around the if fucntion if I used isnotnull. Can you please type out waht you're thinking with the 3 clauses please?

[richgalloway]

This is what I'm thinking.

Matched=if(isnotnull(mvfind(DNS,Identified_Host_Formatted)) OR isnotnull(mvfind(DNS,DNS_Matched)),1,0)

If it doesn't work then please include the exact query you're testing in your reply.

[atebysandwich]

The results were literally the same as my originally search. My search is not different now than what I used from yours.

[atebysandwich]

My requirements are, using mulit-values, if DNS is listed in DNS_Matched, have matched=1

[richgalloway]

It's time to stop the piecemeal business.  Please share the full (sanitized, if necessary) query that produces the current results and perhaps someone can find a way to produce the desired results.