Splunk Search

How to use mvfilter Function to search two field values?

Mr_Adate
Explorer

Hello All,

I wanted to search  "field_A" data value from "field_B" data values into "field_C" but only if field_A values match with field_B

Data example

Sr.     field_A                                               field_B

1.    AD_Name_A                                    AD_Name_C; AD_Name_Z; AD_Name_A;AD_Name_B

2.   AD_Name_K                                      AD_Name_K; AD_Name_C; AD_Name_D

3.  AD_Name_M                                      AD_Name_J;AD_Name_K

4.  AD_Name_Z                                       AD_Name_C;AD_Name_Z;AD_Name_L;AD_Name_O;AD_Name_D

 

I am trying to use below mentioned command but not working.

| makemv delim=";" field_B

| eval field_C =mvfilter(if('field_A'='field_B',"Match",'field_A'))

 

I am also tried below command but no luck.

 

| eval field_C=mvfilter(match('field_A'='field_B')

 

Please help me to on it.

 

 

 

                                                                     

 

 

Labels (1)
0 Karma

Mr_Adate
Explorer

@ITWhisperer Thank you. Your command is not giving me output if  field_A have more than 1 values like

sr.  field_A                                field_B
1. AD_Name_C                      AD_Name_C

    AD_Name_B                      AD_Name_B

    AD_Name_A                      AD_Name_A

 

2. AD_Name_K                      AD_Name_K

     AD_Name_L                      AD_Name_L

 

please help

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| foreach mode=multivalue field_A
    [| eval field_C=if(isnotnull(mvfind(field_B,<<ITEM>>)),if(isnull(field_C),<<ITEM>>,mvappend(field_C,<<ITEM>>)),field_C)]
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval field_C =if(isnotnull(mvfind(field_B,field_A)),field_A,null())
0 Karma
Get Updates on the Splunk Community!

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

&#x1f5e3; You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...

What's New in Splunk Observability - October 2025

What’s New?    We’re excited to announce the latest enhancements to Splunk Observability Cloud and share ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...