Splunk Search

How to mvfilter() the results of mvappend()?

woodams
Engager

I have several fields I want to lump into 1 multivalue field and remove blanks.

At the start of an event, there are up to 6 IP Addresses, either internal or external, but not both (they are the source IP, plus any LB hops along the way). They get extracted to either internal_src_ip# or external_src_ip#.  If it is an internal IP, then the external_src_ip# will be "-", i.e. blank.

If I run 

 

 

| eval OriginIP2 = mvappend(internal_src_ip, external_src_ip, internal_src_ip2, external_src_ip2, internal_src_ip3, external_src_ip3, internal_src_ip4, external_src_ip4, internal_src_ip5, external_src_ip5, internal_src_ip6, external_src_ip6 )
| eval OriginIP2 = mvfilter( match( OriginIP2, "^(?!-)" ) )

 

 

I get exactly what I want. A multivalue list in the field "OriginIP2" with "-" removed.

However putting it together in 1 line (to automate as a Calculated Field) gives me an error.

 

 

| eval OriginIP2 = mvfilter(  match( mvappend(internal_src_ip, external_src_ip, internal_src_ip2, external_src_ip2, internal_src_ip3, external_src_ip3, internal_src_ip4, external_src_ip4, internal_src_ip5, external_src_ip5, internal_src_ip6, external_src_ip6 ), "^(?!-)") )
Error in 'eval' command: The arguments to the 'mvfilter' function are invalid. 

 

 

As I read the docs, mvappend() should be returning a single mv field for match() to operate on, and then for match() to send to mvfilter().

 

What am I missing?

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

As the documentation says, mvfilter requires a reference to a mv-field (not a field), which is why your command throws an error. Try something like this:

| eval OriginIP2 = mvappend(if(internal_src_ip="-",null(),internal_src_ip), if(external_src_ip="-",null(),external_src_ip), if(internal_src_ip2="-",null(),internal_src_ip2), if(external_src_ip2="-",null(),external_src_ip2), if(internal_src_ip3="-",null(),internal_src_ip3),if(external_src_ip3="-",null(),external_src_ip3), if(internal_src_ip4="-",null(),internal_src_ip4), if(external_src_ip4="-",null(),external_src_ip4),if(internal_src_ip5="-",null(),internal_src_ip5), if(external_src_ip5="-",null(),external_src_ip5), if(internal_src_ip6="-",null(),internal_src_ip6), if(external_src_ip6="-",null(),external_src_ip6))
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...