Splunk Search

How to mvfilter() the results of mvappend()?

woodams
Engager

I have several fields I want to lump into 1 multivalue field and remove blanks.

At the start of an event, there are up to 6 IP Addresses, either internal or external, but not both (they are the source IP, plus any LB hops along the way). They get extracted to either internal_src_ip# or external_src_ip#.  If it is an internal IP, then the external_src_ip# will be "-", i.e. blank.

If I run 

 

 

| eval OriginIP2 = mvappend(internal_src_ip, external_src_ip, internal_src_ip2, external_src_ip2, internal_src_ip3, external_src_ip3, internal_src_ip4, external_src_ip4, internal_src_ip5, external_src_ip5, internal_src_ip6, external_src_ip6 )
| eval OriginIP2 = mvfilter( match( OriginIP2, "^(?!-)" ) )

 

 

I get exactly what I want. A multivalue list in the field "OriginIP2" with "-" removed.

However putting it together in 1 line (to automate as a Calculated Field) gives me an error.

 

 

| eval OriginIP2 = mvfilter(  match( mvappend(internal_src_ip, external_src_ip, internal_src_ip2, external_src_ip2, internal_src_ip3, external_src_ip3, internal_src_ip4, external_src_ip4, internal_src_ip5, external_src_ip5, internal_src_ip6, external_src_ip6 ), "^(?!-)") )
Error in 'eval' command: The arguments to the 'mvfilter' function are invalid. 

 

 

As I read the docs, mvappend() should be returning a single mv field for match() to operate on, and then for match() to send to mvfilter().

 

What am I missing?

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

As the documentation says, mvfilter requires a reference to a mv-field (not a field), which is why your command throws an error. Try something like this:

| eval OriginIP2 = mvappend(if(internal_src_ip="-",null(),internal_src_ip), if(external_src_ip="-",null(),external_src_ip), if(internal_src_ip2="-",null(),internal_src_ip2), if(external_src_ip2="-",null(),external_src_ip2), if(internal_src_ip3="-",null(),internal_src_ip3),if(external_src_ip3="-",null(),external_src_ip3), if(internal_src_ip4="-",null(),internal_src_ip4), if(external_src_ip4="-",null(),external_src_ip4),if(internal_src_ip5="-",null(),internal_src_ip5), if(external_src_ip5="-",null(),external_src_ip5), if(internal_src_ip6="-",null(),internal_src_ip6), if(external_src_ip6="-",null(),external_src_ip6))
0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...