Hello all,
Trying to figure out how to search or filter based on the matches in my case statement. I guess also want to figure out if this is the correct way to approach this search.
searchHere | eval status=case(ship=_pro, "processed", ship=_ma, "sent") | stats values(field1), values(field2), values(filed3), values(status) by fieldx
Now, I want to search the contents of the values()
function for only those that contain both strings matched in my case statement. I can't focus on a count because there are many other variations that could potentially match and thus making the count >1. Something like "if the field status contains the values: processed AND sent" in any order show me those events.
Thanks for the help in advance.
This should do it
Updated (replaced mvfind with mvfilter)
searchHere | eval status=case(ship=_pro, "processed", ship=_ma, "sent") | stats values(field1), values(field2), values(filed3), values(status) as status by fieldx | where isnotnull(mvfilter(match(status,"processed"))) AND isnotnull(mvfilter(match(status,"sent")))
This should do it
Updated (replaced mvfind with mvfilter)
searchHere | eval status=case(ship=_pro, "processed", ship=_ma, "sent") | stats values(field1), values(field2), values(filed3), values(status) as status by fieldx | where isnotnull(mvfilter(match(status,"processed"))) AND isnotnull(mvfilter(match(status,"sent")))
Thanks for the help. I ran the search above and get the following error:
Error in 'where' command: The arguments to the 'mvfind' function are invalid.
I don't see anything referencing mvfind(match in the docs. Is that just saying match for the value in fieldx? Did you mean to use mvfilter? I tried that and that seems to return just the values I'm searching for.
Oops..wrong function used. Try the updated answer.
thanks for the help, that did the trick!
When you use values(), the resultant field is multi-value. This means it can have several values simultaneously. Testing for "this and that" is as simple as "mv_field=<value1> mv_field=<value2>" (the AND in between is implied). It might benefit you to use an "AS ..." clause in the stats call to rename the field to something easier to manage.
Try this
searchHere (ship="_pro" OR ship="_ma"| eval status=case(ship=_pro, "processed", ship=_ma, "sent") | stats values(field1), values(field2), values(filed3), values(status) by fieldx
*OR*
searchHere | eval status=case(ship=_pro, "processed", ship=_ma, "sent", 1=1, "other") | search status="processed" OR status="sent" | stats values(field1), values(field2), values(filed3), values(status) by fieldx
Thanks for the reply, but the second search will match on EITHER/OR value. I only want to show results where BOTH values exists. Same issue with the first search, gives me either/or one or the other value.