How to filter a list of timestamps less than _time

[weidertc]

I need to filter a list of timestamps which are less than _time.

this works:

| makeresults count=1
| eval timestamps = mvappend("1570000000", "1570000020")
| eval older = mvfilter(timestamps < 1570000010)

but the compared value is whatever is in _time.  this does not work:

| makeresults count=1
| eval timestamps = mvappend("1570000000", "1570000020")
| eval _time = 1570000010
| eval older = mvfilter(timestamps < _time)

I know timestamps work, because this does work:

| makeresults count=1
| eval timestamps = mvappend("1570000000", "1570000020")
| eval older = mvfilter(timestamps < now())

Why does now() and static values work, but this does not:

| makeresults count=1
| eval timestamps = mvappend("1570000000", "1570000020")
| eval now_time = now()
| eval older = mvfilter(timestamps < now_time)

How can i get a variable in there to compare, since i need to compare the list to _time?

[ITWhisperer · Accepted solution]

mvfilter can only reference one field at a time

Description

This function filters a multivalue field based on an arbitrary Boolean expression. The Boolean expression can reference ONLY ONE field at a time.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/MultivalueEvalFunctions#mvfilter...

Try like this:

| makeresults count=1
| eval timestamps = mvappend("1700000000", "1800000020")
| foreach mode=multivalue timestamps
    [| eval older=if(<<ITEM>> < _time, mvappend(older,<<ITEM>>),older)]

[weidertc]

whoa! i didn't know about mode=multivalue.  thanks!

[richgalloway]

Have you tried using single quotes to tell eval you're referring to a field name?

| eval older = mvfilter(timestamps < '_time')