How to use mvfilter to get list of data that contain less and only less than the specific data?

[limalbert]

Hi all,

I have a question related to my other question.

https://answers.splunk.com/answers/518074/how-to-get-a-count-of-stats-list-that-contains-a-s.html

Boundary: date and user. There are at least 1000 data. Sample example below.

Date User list(data)
3/31/17 user1 1, 2
3/31/17 user2 1, 5
3/31/17 user3 2, 10

Current search:
your current search giving Date User list(data)
| where isnotnull(mvfilter('list(data)'<3))
| chart count(user) by date

Let say I want to count user who have list(data) that contains number less and only less than "3". Then, the user count answer should be "1". Using the query above, I am getting result of "3". I tried adding "!> 2", but it won't run.

Eventually, I want to make side by side comparison between count(user) with list of data >3, and count of user with list of data less and only less than 3.

[somesoni2 · Accepted solution]

Do like this. Inverted the conditions. Basically you want to count events where list(data) only contains values < 3. For that, we try to find events where list(data) has values greater than 3, if it's null (no value is greater than 3) then it'll be counted.

your current search giving Date User list(data)
| where isnull(mvfilter('list(data)'>3))
| chart count(user) by date

[limalbert]

You are the best!
Where do you find documentation for isnull and isnotnull? Seriously couldn't find it.

[somesoni2]

Below link give details of all the functions that you can use with eval and where commands.

docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions