Splunk Search

How to use variable on mvfilter regex match?

LearningGuy
Motivator


If I used variable in the mvfilter match, i got the following error
Error in 'EvalCommand': The arguments to the 'mvfilter' function are invalid.

If I replaced the partialcode with a string, it worked fine
Please help. Thank you so much

| makeresults
| eval fullcode= "code-abc-1111,code-abc-2222,code-xyz-1111,code-xyz-222"
| eval partialcode="code-abc"
| makemv delim="," fullcode
| eval fullcode2=mvfilter(match(fullcode,partialcode))


This one worked fine

| makeresults
| eval fullcode= "code-abc-1111,code-abc-2222,code-xyz-1111,code-xyz-222"
| eval partialcode="code-abc"
| makemv delim="," fullcode
| eval fullcode2=mvfilter(match(fullcode,"code-abc"))


 

Labels (1)
Tags (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

mvfilter only takes a single field

https://docs.splunk.com/Documentation/Splunk/9.2.0/SearchReference/MultivalueEvalFunctions#mvfilter....

Use mvmap instead

| makeresults
| eval fullcode= "code-abc-1111,code-abc-2222,code-xyz-1111,code-xyz-222"
| eval partialcode="code-abc"
| makemv delim="," fullcode
| eval fullcode2=mvmap(fullcode, if(match(fullcode,partialcode), fullcode, null()))

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

mvfilter only takes a single field

https://docs.splunk.com/Documentation/Splunk/9.2.0/SearchReference/MultivalueEvalFunctions#mvfilter....

Use mvmap instead

| makeresults
| eval fullcode= "code-abc-1111,code-abc-2222,code-xyz-1111,code-xyz-222"
| eval partialcode="code-abc"
| makemv delim="," fullcode
| eval fullcode2=mvmap(fullcode, if(match(fullcode,partialcode), fullcode, null()))

 

LearningGuy
Motivator

Hi @bowesmana 

Your solution worked and you provided better example than Splunk documentation
I appreciate your help. Thanks

I thought I used one field on my mvfilter, which is fullcode...  I guess partialcode is considered  the second field..

| eval fullcode2=mvfilter(match(fullcode,partialcode))






0 Karma

bowesmana
SplunkTrust
SplunkTrust

You are right, partialcode is the second field - mvfilter has a few use cases, but I've generally found I'm always wanting to relate it to some other field, so when mvmap came along in Splunk 8, I almost never use mvfilter now - even when I could.

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...