How to achieve complex filtering on MVFields?

[ett]

I am attempting to build a search that pulls back all logs that have a value in a multi-value field but do not have other values. With a few values I do not care if exist or not.

To break it down more.

The field "names" must have "bob".
The field "names" can have any or all "tom","dan","harry" but is not required to have them.
The field "names" cannot have any other value.
I do not have a full list of the names and they can change over time so it is not possible to make a list of the "names" I do not want.

I need other values from the logs just filtering by the "names" field as an example.

As a few examples:

"bob"= returned in the search
"bob","tom" = returned in the search
"tom","dan" = not returned in the search
"bob","sam" = not returned in the search
"bob","harry","fred" = not returned in search

I am having trouble figuring out what to use to exclude multi-value fields in this way.

[somesoni2 · Accepted solution]

Give this a try (first 4 lines are to generate sample data, replace it with your search)

|  makeresults 
|  eval names=split("bob bob,tom tom,**bleep** bob,sam bob,harry,fred"," ") 
|  mvexpand names
| eval name=split(names,",")
| where isnotnull(mvfind(names,"bob")) AND isnull(mvfilter(NOT match(names,"(bob|tom|\*\*bleep\*\*|harry)$")))

[ett]

That where line at the bottom got me where I needed to be.

Thank you for your quick response.