Splunk Search

How to Pull specific value from MV field?

morgantay96
Path Finder

Hi All,

I have a mv field with a bunch of different values. I want to learn how to pull specific values based on string criteria. For examle the multivalue field may contain

"App: A;  sn_ubs;  Owner_Bob; Criticality_3;"

How would I create an eval to pull just the "sn_ubs" into a new field name SN?

I am unsure of what manipulation does this. I have tried mvfilter and that works but doesn't break out the value.

Labels (3)
0 Karma
1 Solution

morgantay96
Path Finder

If anyone has this issue I figured it out.


Just ensure your field is multivalue then use mvfilter

| eval [new_field] = mvfilter(match([old mv field], "[string to match]"))

View solution in original post

0 Karma

morgantay96
Path Finder

If anyone has this issue I figured it out.


Just ensure your field is multivalue then use mvfilter

| eval [new_field] = mvfilter(match([old mv field], "[string to match]"))

0 Karma

morgantay96
Path Finder

Also I would want to set a default value if a record does not contain that "sn_ubs" entry

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...