Splunk Search

How to use mvfilter Function to search two field values?

Mr_Adate
Explorer

Hello All,

I wanted to search  "field_A" data value from "field_B" data values into "field_C" but only if field_A values match with field_B

Data example

Sr.     field_A                                               field_B

1.    AD_Name_A                                    AD_Name_C; AD_Name_Z; AD_Name_A;AD_Name_B

2.   AD_Name_K                                      AD_Name_K; AD_Name_C; AD_Name_D

3.  AD_Name_M                                      AD_Name_J;AD_Name_K

4.  AD_Name_Z                                       AD_Name_C;AD_Name_Z;AD_Name_L;AD_Name_O;AD_Name_D

 

I am trying to use below mentioned command but not working.

| makemv delim=";" field_B

| eval field_C =mvfilter(if('field_A'='field_B',"Match",'field_A'))

 

I am also tried below command but no luck.

 

| eval field_C=mvfilter(match('field_A'='field_B')

 

Please help me to on it.

 

 

 

                                                                     

 

 

Labels (1)
0 Karma

Mr_Adate
Explorer

@ITWhisperer Thank you. Your command is not giving me output if  field_A have more than 1 values like

sr.  field_A                                field_B
1. AD_Name_C                      AD_Name_C

    AD_Name_B                      AD_Name_B

    AD_Name_A                      AD_Name_A

 

2. AD_Name_K                      AD_Name_K

     AD_Name_L                      AD_Name_L

 

please help

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| foreach mode=multivalue field_A
    [| eval field_C=if(isnotnull(mvfind(field_B,<<ITEM>>)),if(isnull(field_C),<<ITEM>>,mvappend(field_C,<<ITEM>>)),field_C)]
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval field_C =if(isnotnull(mvfind(field_B,field_A)),field_A,null())
0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...