Splunk Search

How to use mvfilter to get list of data that contain less and only less than the specific data?

limalbert
Path Finder

Hi all,

I have a question related to my other question.

https://answers.splunk.com/answers/518074/how-to-get-a-count-of-stats-list-that-contains-a-s.html

Boundary: date and user. There are at least 1000 data. Sample example below.

Date User list(data)
3/31/17 user1 1, 2
3/31/17 user2 1, 5
3/31/17 user3 2, 10

Current search:
your current search giving Date User list(data)
| where isnotnull(mvfilter('list(data)'<3))
| chart count(user) by date

Let say I want to count user who have list(data) that contains number less and only less than "3". Then, the user count answer should be "1". Using the query above, I am getting result of "3". I tried adding "!> 2", but it won't run.

Eventually, I want to make side by side comparison between count(user) with list of data >3, and count of user with list of data less and only less than 3.

0 Karma
1 Solution

somesoni2
Revered Legend

Do like this. Inverted the conditions. Basically you want to count events where list(data) only contains values < 3. For that, we try to find events where list(data) has values greater than 3, if it's null (no value is greater than 3) then it'll be counted.

your current search giving Date User list(data)
| where isnull(mvfilter('list(data)'>3))
| chart count(user) by date

View solution in original post

somesoni2
Revered Legend

Do like this. Inverted the conditions. Basically you want to count events where list(data) only contains values < 3. For that, we try to find events where list(data) has values greater than 3, if it's null (no value is greater than 3) then it'll be counted.

your current search giving Date User list(data)
| where isnull(mvfilter('list(data)'>3))
| chart count(user) by date

limalbert
Path Finder

You are the best!
Where do you find documentation for isnull and isnotnull? Seriously couldn't find it.

0 Karma

somesoni2
Revered Legend

Below link give details of all the functions that you can use with eval and where commands.

docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...