How to use variable on mvfilter regex match?

[LearningGuy]

If I used variable in the mvfilter match, i got the following error
Error in 'EvalCommand': The arguments to the 'mvfilter' function are invalid.

If I replaced the partialcode with a string, it worked fine
Please help. Thank you so much

| makeresults
| eval fullcode= "code-abc-1111,code-abc-2222,code-xyz-1111,code-xyz-222"
| eval partialcode="code-abc"
| makemv delim="," fullcode
| eval fullcode2=mvfilter(match(fullcode,partialcode))

This one worked fine

| makeresults
| eval fullcode= "code-abc-1111,code-abc-2222,code-xyz-1111,code-xyz-222"
| eval partialcode="code-abc"
| makemv delim="," fullcode
| eval fullcode2=mvfilter(match(fullcode,"code-abc"))

[bowesmana · Accepted solution]

mvfilter only takes a single field

https://docs.splunk.com/Documentation/Splunk/9.2.0/SearchReference/MultivalueEvalFunctions#mvfilter....

Use mvmap instead

| makeresults
| eval fullcode= "code-abc-1111,code-abc-2222,code-xyz-1111,code-xyz-222"
| eval partialcode="code-abc"
| makemv delim="," fullcode
| eval fullcode2=mvmap(fullcode, if(match(fullcode,partialcode), fullcode, null()))

[LearningGuy]

Hi @bowesmana 

Your solution worked and you provided better example than Splunk documentation
I appreciate your help. Thanks

I thought I used one field on my mvfilter, which is fullcode...  I guess partialcode is considered  the second field..

| eval fullcode2=mvfilter(match(fullcode,partialcode))

[bowesmana]

You are right, partialcode is the second field - mvfilter has a few use cases, but I've generally found I'm always wanting to relate it to some other field, so when mvmap came along in Splunk 8, I almost never use mvfilter now - even when I could.