Splunk Search

How to create a multivalue FieldC with the common values found in multivalue fields FieldA and FieldB?

vbumgarner
Contributor

I have two fields that are multivalue, and I need to know what they have in common.

For instance, given:
a=[1,2,3]
b=[2,3,4]
I want to create:
c=[2,3]

I made it work with some crazy mvexpand, but I'd really rather not do that. I tried to make it work using a combination of mvfilter and mvfind, but couldn't make that work, either.

Any thoughts on how to do this more efficiently?

Cheers.

0 Karma

fdi01
Motivator

you can use also mvindex and mvzip command to do it.

the if() or case() and match( ) functions are used to build your condictions fine on.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...