Splunk Search

How to Pull specific value from MV field?

morgantay96
Path Finder

Hi All,

I have a mv field with a bunch of different values. I want to learn how to pull specific values based on string criteria. For examle the multivalue field may contain

"App: A;  sn_ubs;  Owner_Bob; Criticality_3;"

How would I create an eval to pull just the "sn_ubs" into a new field name SN?

I am unsure of what manipulation does this. I have tried mvfilter and that works but doesn't break out the value.

Labels (3)
0 Karma
1 Solution

morgantay96
Path Finder

If anyone has this issue I figured it out.


Just ensure your field is multivalue then use mvfilter

| eval [new_field] = mvfilter(match([old mv field], "[string to match]"))

View solution in original post

0 Karma

morgantay96
Path Finder

If anyone has this issue I figured it out.


Just ensure your field is multivalue then use mvfilter

| eval [new_field] = mvfilter(match([old mv field], "[string to match]"))

0 Karma

morgantay96
Path Finder

Also I would want to set a default value if a record does not contain that "sn_ubs" entry

0 Karma
Get Updates on the Splunk Community!

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...