Splunk Search

How to use mvfilter Function to search two field values?

Mr_Adate
Explorer

Hello All,

I wanted to search  "field_A" data value from "field_B" data values into "field_C" but only if field_A values match with field_B

Data example

Sr.     field_A                                               field_B

1.    AD_Name_A                                    AD_Name_C; AD_Name_Z; AD_Name_A;AD_Name_B

2.   AD_Name_K                                      AD_Name_K; AD_Name_C; AD_Name_D

3.  AD_Name_M                                      AD_Name_J;AD_Name_K

4.  AD_Name_Z                                       AD_Name_C;AD_Name_Z;AD_Name_L;AD_Name_O;AD_Name_D

 

I am trying to use below mentioned command but not working.

| makemv delim=";" field_B

| eval field_C =mvfilter(if('field_A'='field_B',"Match",'field_A'))

 

I am also tried below command but no luck.

 

| eval field_C=mvfilter(match('field_A'='field_B')

 

Please help me to on it.

 

 

 

                                                                     

 

 

Labels (1)
0 Karma

Mr_Adate
Explorer

@ITWhisperer Thank you. Your command is not giving me output if  field_A have more than 1 values like

sr.  field_A                                field_B
1. AD_Name_C                      AD_Name_C

    AD_Name_B                      AD_Name_B

    AD_Name_A                      AD_Name_A

 

2. AD_Name_K                      AD_Name_K

     AD_Name_L                      AD_Name_L

 

please help

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| foreach mode=multivalue field_A
    [| eval field_C=if(isnotnull(mvfind(field_B,<<ITEM>>)),if(isnull(field_C),<<ITEM>>,mvappend(field_C,<<ITEM>>)),field_C)]
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval field_C =if(isnotnull(mvfind(field_B,field_A)),field_A,null())
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...