Splunk Search

How to create and extract values from multivalue field ?

karthi2809
Builder

Hello to all,

I have a multivalue field with a content.errormsg with values and also with a null value. If the null value in the fields it will not showing any results in the output
example:

errormsg
closed connection
Empty String
null


needed result:

errormsg
closed connection
Empty String
Labels (1)
0 Karma

marnall
Builder

Sure thing, you can use the mvfilter eval function to get rid of the unwanted value in the multivalue field

 

| eval yourfield = mvfilter(yourfield != "null")

ITWhisperer
SplunkTrust
SplunkTrust

Do you mean something like this?

| eval errormsg=mvfilter(errormsg!="null")
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...