Splunk Search

How to use mvfilter Function to search two field values?

Mr_Adate
Explorer

Hello All,

I wanted to search  "field_A" data value from "field_B" data values into "field_C" but only if field_A values match with field_B

Data example

Sr.     field_A                                               field_B

1.    AD_Name_A                                    AD_Name_C; AD_Name_Z; AD_Name_A;AD_Name_B

2.   AD_Name_K                                      AD_Name_K; AD_Name_C; AD_Name_D

3.  AD_Name_M                                      AD_Name_J;AD_Name_K

4.  AD_Name_Z                                       AD_Name_C;AD_Name_Z;AD_Name_L;AD_Name_O;AD_Name_D

 

I am trying to use below mentioned command but not working.

| makemv delim=";" field_B

| eval field_C =mvfilter(if('field_A'='field_B',"Match",'field_A'))

 

I am also tried below command but no luck.

 

| eval field_C=mvfilter(match('field_A'='field_B')

 

Please help me to on it.

 

 

 

                                                                     

 

 

Labels (1)
0 Karma

Mr_Adate
Explorer

@ITWhisperer Thank you. Your command is not giving me output if  field_A have more than 1 values like

sr.  field_A                                field_B
1. AD_Name_C                      AD_Name_C

    AD_Name_B                      AD_Name_B

    AD_Name_A                      AD_Name_A

 

2. AD_Name_K                      AD_Name_K

     AD_Name_L                      AD_Name_L

 

please help

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| foreach mode=multivalue field_A
    [| eval field_C=if(isnotnull(mvfind(field_B,<<ITEM>>)),if(isnull(field_C),<<ITEM>>,mvappend(field_C,<<ITEM>>)),field_C)]
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval field_C =if(isnotnull(mvfind(field_B,field_A)),field_A,null())
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...