Splunk Search

How do I search for Filed Values in a Different Multi-Value Field

atebysandwich
Path Finder

I have two fields: DNS and DNS_Matched. The latter is a multi-value field. How can I see if a field value in DNS is in one  of the multi-value field in DNS_Matched?

Example:

DNSDNS_Matached
host1host1
host1-a
host1-r
host2host2
host2-a
host2-r
Labels (4)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the mvfind function.

| eval present=if(isnotnull(mvfind(DNS_Matched, DNS)),"yes", "no")

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

atebysandwich
Path Finder

This worked in a vacuum but I get an error saying it's expecting IN when I tried adding it to existing Eval statement

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share the existing eval statement so someone can figure out how to add mvfind.

---
If this reply helps you, Karma would be appreciated.
0 Karma

atebysandwich
Path Finder

Matched=if(match(DNS,Identified_Host_Formatted) OR match(DNS,DNS_Matched),1,0)

I Would like to add the search you created to this. These existing only work on single valued fields

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use mvfind in place of match for multi-value fields.

---
If this reply helps you, Karma would be appreciated.
0 Karma

atebysandwich
Path Finder

This didn't seem to work. I got error saying it could only use Boolean, or an error if around the if fucntion if I used isnotnull. Can you please type out waht you're thinking with the 3 clauses please?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This is what I'm thinking.

Matched=if(isnotnull(mvfind(DNS,Identified_Host_Formatted)) OR isnotnull(mvfind(DNS,DNS_Matched)),1,0)

If it doesn't work then please include the exact query you're testing in your reply.

---
If this reply helps you, Karma would be appreciated.
0 Karma

atebysandwich
Path Finder

The results were literally the same as my originally search. My search is not different now than what I used from yours.

0 Karma

atebysandwich
Path Finder

My requirements are, using mulit-values, if DNS is listed in DNS_Matched, have matched=1

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's time to stop the piecemeal business.  Please share the full (sanitized, if necessary) query that produces the current results and perhaps someone can find a way to produce the desired results.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...