Splunk Search

How to mvfilter() the results of mvappend()?

woodams
Explorer

I have several fields I want to lump into 1 multivalue field and remove blanks.

At the start of an event, there are up to 6 IP Addresses, either internal or external, but not both (they are the source IP, plus any LB hops along the way). They get extracted to either internal_src_ip# or external_src_ip#.  If it is an internal IP, then the external_src_ip# will be "-", i.e. blank.

If I run 

 

 

| eval OriginIP2 = mvappend(internal_src_ip, external_src_ip, internal_src_ip2, external_src_ip2, internal_src_ip3, external_src_ip3, internal_src_ip4, external_src_ip4, internal_src_ip5, external_src_ip5, internal_src_ip6, external_src_ip6 )
| eval OriginIP2 = mvfilter( match( OriginIP2, "^(?!-)" ) )

 

 

I get exactly what I want. A multivalue list in the field "OriginIP2" with "-" removed.

However putting it together in 1 line (to automate as a Calculated Field) gives me an error.

 

 

| eval OriginIP2 = mvfilter(  match( mvappend(internal_src_ip, external_src_ip, internal_src_ip2, external_src_ip2, internal_src_ip3, external_src_ip3, internal_src_ip4, external_src_ip4, internal_src_ip5, external_src_ip5, internal_src_ip6, external_src_ip6 ), "^(?!-)") )
Error in 'eval' command: The arguments to the 'mvfilter' function are invalid. 

 

 

As I read the docs, mvappend() should be returning a single mv field for match() to operate on, and then for match() to send to mvfilter().

 

What am I missing?

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

As the documentation says, mvfilter requires a reference to a mv-field (not a field), which is why your command throws an error. Try something like this:

| eval OriginIP2 = mvappend(if(internal_src_ip="-",null(),internal_src_ip), if(external_src_ip="-",null(),external_src_ip), if(internal_src_ip2="-",null(),internal_src_ip2), if(external_src_ip2="-",null(),external_src_ip2), if(internal_src_ip3="-",null(),internal_src_ip3),if(external_src_ip3="-",null(),external_src_ip3), if(internal_src_ip4="-",null(),internal_src_ip4), if(external_src_ip4="-",null(),external_src_ip4),if(internal_src_ip5="-",null(),internal_src_ip5), if(external_src_ip5="-",null(),external_src_ip5), if(internal_src_ip6="-",null(),internal_src_ip6), if(external_src_ip6="-",null(),external_src_ip6))
0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...