Splunk Search

How to use mvfilter Function to search two field values?

Mr_Adate
Explorer

Hello All,

I wanted to search  "field_A" data value from "field_B" data values into "field_C" but only if field_A values match with field_B

Data example

Sr.     field_A                                               field_B

1.    AD_Name_A                                    AD_Name_C; AD_Name_Z; AD_Name_A;AD_Name_B

2.   AD_Name_K                                      AD_Name_K; AD_Name_C; AD_Name_D

3.  AD_Name_M                                      AD_Name_J;AD_Name_K

4.  AD_Name_Z                                       AD_Name_C;AD_Name_Z;AD_Name_L;AD_Name_O;AD_Name_D

 

I am trying to use below mentioned command but not working.

| makemv delim=";" field_B

| eval field_C =mvfilter(if('field_A'='field_B',"Match",'field_A'))

 

I am also tried below command but no luck.

 

| eval field_C=mvfilter(match('field_A'='field_B')

 

Please help me to on it.

 

 

 

                                                                     

 

 

Labels (1)
0 Karma

Mr_Adate
Explorer

@ITWhisperer Thank you. Your command is not giving me output if  field_A have more than 1 values like

sr.  field_A                                field_B
1. AD_Name_C                      AD_Name_C

    AD_Name_B                      AD_Name_B

    AD_Name_A                      AD_Name_A

 

2. AD_Name_K                      AD_Name_K

     AD_Name_L                      AD_Name_L

 

please help

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| foreach mode=multivalue field_A
    [| eval field_C=if(isnotnull(mvfind(field_B,<<ITEM>>)),if(isnull(field_C),<<ITEM>>,mvappend(field_C,<<ITEM>>)),field_C)]
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval field_C =if(isnotnull(mvfind(field_B,field_A)),field_A,null())
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...