Splunk Search

How to mvfilter() the results of mvappend()?

woodams
Engager

I have several fields I want to lump into 1 multivalue field and remove blanks.

At the start of an event, there are up to 6 IP Addresses, either internal or external, but not both (they are the source IP, plus any LB hops along the way). They get extracted to either internal_src_ip# or external_src_ip#.  If it is an internal IP, then the external_src_ip# will be "-", i.e. blank.

If I run 

 

 

| eval OriginIP2 = mvappend(internal_src_ip, external_src_ip, internal_src_ip2, external_src_ip2, internal_src_ip3, external_src_ip3, internal_src_ip4, external_src_ip4, internal_src_ip5, external_src_ip5, internal_src_ip6, external_src_ip6 )
| eval OriginIP2 = mvfilter( match( OriginIP2, "^(?!-)" ) )

 

 

I get exactly what I want. A multivalue list in the field "OriginIP2" with "-" removed.

However putting it together in 1 line (to automate as a Calculated Field) gives me an error.

 

 

| eval OriginIP2 = mvfilter(  match( mvappend(internal_src_ip, external_src_ip, internal_src_ip2, external_src_ip2, internal_src_ip3, external_src_ip3, internal_src_ip4, external_src_ip4, internal_src_ip5, external_src_ip5, internal_src_ip6, external_src_ip6 ), "^(?!-)") )
Error in 'eval' command: The arguments to the 'mvfilter' function are invalid. 

 

 

As I read the docs, mvappend() should be returning a single mv field for match() to operate on, and then for match() to send to mvfilter().

 

What am I missing?

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

As the documentation says, mvfilter requires a reference to a mv-field (not a field), which is why your command throws an error. Try something like this:

| eval OriginIP2 = mvappend(if(internal_src_ip="-",null(),internal_src_ip), if(external_src_ip="-",null(),external_src_ip), if(internal_src_ip2="-",null(),internal_src_ip2), if(external_src_ip2="-",null(),external_src_ip2), if(internal_src_ip3="-",null(),internal_src_ip3),if(external_src_ip3="-",null(),external_src_ip3), if(internal_src_ip4="-",null(),internal_src_ip4), if(external_src_ip4="-",null(),external_src_ip4),if(internal_src_ip5="-",null(),internal_src_ip5), if(external_src_ip5="-",null(),external_src_ip5), if(internal_src_ip6="-",null(),internal_src_ip6), if(external_src_ip6="-",null(),external_src_ip6))
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...