How to filter a multivalue field using a subsearch?

[chrids]

I found a close answer to what I'm looking for here:

https://community.splunk.com/t5/Splunk-Search/Why-cant-i-supply-a-field-as-value-for-mvfilter/m-p/45...

The example, excludes 1 example, add \"a\" for more, which works:

| makeresults 
| eval mymvfield ="a b c" 
| makemv mymvfield 
| eval excludes = mvfilter(NOT in(mymvfield, 
    [| makeresults 
    | eval search = "\"b\"" 
    | return $search]))

What I'm looking for, use return which seemingly translates to (b) OR (a) ... :

| makeresults 
| eval mymvfield ="a b c" 
| makemv mymvfield 
| eval excludes = mvfilter(NOT in(mymvfield, 
    [| search something
    | return 3 $some_field]))

I get weird parsing errors which I thought maybe could be solved by using "format" but I'm at a loss.

I reckon you could probably solve this by doing a subsearch and filtering prior to making the multivalue field, I'm however curious if you can make this query work.

Please let me know if anything is unclear.

[ITWhisperer]

Try something like this

| makeresults 
| eval mymvfield ="a b c" 
| makemv mymvfield 
| eval excludes = mvfilter(NOT  
    [| makeresults 
    | eval mymvfield = "b" 
    | append
        [| makeresults
        | eval mymvfield = "c"]
    | format "" "" "" "" "AND" ""])

[chrids]

It's almost there, I can't manage to replace the two "| makeresults/| append" with a "| search" however in the final query.

This:

| makeresults 
| eval mymvfield = "b" 
| append
   [| makeresults
    | eval mymvfield = "c"]
    | format "" "" "" "" "AND" ""

 evaluates to:

mymvfield="b"  AND  mymvfield="c"

 
My reduced use-case:

| makeresults
| append [
   | search foo
   | fields bar
   | head 2]
| format "" "" "" "" "AND" ""

evaluates to:

bar="result1"  AND  bar="result2"  

Wrapping that into mvfilter(NOT [ .. ]) gives me: Error in 'eval' command: The expression is malformed. 

[ITWhisperer]

Please share your actual search to determine what might be amiss

[chrids]

Got it working! Thanks so much!

I had a syntax error and changed it to a final:

| eval bar_filtered = mvfilter(NOT 
  [ 
    | makeresults
    | append 
      [
        | search foo
        | rename foobar as bar
        | fields bar
      ]
    | format "(" "" "" "" "OR" ")"
  ]
)