How do a search with a string comma separated values ?

[JuanAntunes]

Hello team! How are u?

I have a question about how to search with a comma separated values:

Example:

I have an index with vm's information, like this:

In the column "datastores" returns me all datastores assigned to this VM, so I need to calculate how much freespace I have in this VM.

So I have another index, with the "datastores" information, like this:

I know how to filter just one result, but I don't know how I can filter two or more comma-separated datastores.

Can anyone help me? Thanks in advanced

[ashvinpandey]

@JuanAntunes First split the values of your datastore field as a seperate row then search for it, like below:

| eval datastores=split(datastores,",") 
| mvexpand datastores
| search datastores="*"

Also, If this reply helps you, an upvote would be appreciated.

[JuanAntunes]

Hi @ashvinpandey , first of all thanks for your time!

Here's the query I'm doing with your help, but still to no success.

Thanks again!

[ashvinpandey · Accepted solution]

@JuanAntunes Make sure your subsearch is also having the same datastores field name also the datastores field in the subsearch is also splitted if it contains "," and add below query line after your eval tmp:

| fields tmp

[JuanAntunes]

Thanks so much!  @ashvinpandey  it works!