Splunk Search

Match Substring in Multivalue field and return only the matched substring values

vn_g
Path Finder
ReconnectedTimeReconnectedDetails
2021-02-02T16:46:19.0002021-02-02T08:54:48.000|viceusr|0xA310B|BEK-329999910922|11.188.92.6
2021-02-02T09:29:59.000|shuani|0xF2C223|NTIC4|1.273.6.189
2021-02-02T16:46:19.000|scrmp_install|0x4216DA|GLB163|21.1.218.15
2021-02-02T08:54:48.000
2021-02-02T09:29:59.000
2021-02-02T08:54:48.000|viceusr|0xA310B|BEK-329999910922|11.188.92.6
2021-02-02T09:29:59.000|shuani|0xF2C223|NTIC4|1.273.6.189
2021-02-02T16:46:19.000|scrmp_install|0x4216DA|GLB163|21.1.218.15

 

Both ReconnectedTime and ReconnectedDetails are multivalue fields. In each event the "ReconnectedTime" value [ substring which needs to be valuated ] exists in "ReconnectedDetails" then only the matched substring values of ReconnectedDetails should be the final Ouput.

ReconnectedTimeReconnectedDetails
2021-02-02T16:46:19.0002021-02-02T16:46:19.000|scrmp_install|0x4216DA|GLB163|21.1.218.15
2021-02-02T08:54:48.000
2021-02-02T09:29:59.000
2021-02-02T08:54:48.000|viceusr|0xA310B|BEK-329999910922|11.188.92.6
2021-02-02T09:29:59.000|shuani|0xF2C223|NTIC4|1.273.6.189
0 Karma
1 Solution

manjunathmeti
Champion

ok, try this if you don't want to group: 

<your_base_search>
| mvexpand ReconnectedTime 
| mvexpand ReconnectedDetails 
| where match(ReconnectedDetails, ReconnectedTime) 
| fields ReconnectedTime, ReconnectedDetails

View solution in original post

manjunathmeti
Champion

hi @vn_g ,

Try this:

 

<your_base_search>
| eval ReconnectedTime_orig=ReconnectedTime 
| nomv ReconnectedTime_orig
| mvexpand ReconnectedTime 
| mvexpand ReconnectedDetails 
| where match(ReconnectedDetails, ReconnectedTime) 
| stats values(ReconnectedTime) as ReconnectedTime values(ReconnectedDetails) as ReconnectedDetails by ReconnectedTime_orig 
| fields ReconnectedTime, ReconnectedDetails

 

0 Karma

vn_g
Path Finder

No the output is not as expected. All 3 values of "Reconnected Details" are being displayed for each "ReconnectedTime". Only the sub string value of ReconnectedTime in Reconnected Details should be displayed for Reconnected Details.

 

0 Karma

manjunathmeti
Champion

ok, try this if you don't want to group: 

<your_base_search>
| mvexpand ReconnectedTime 
| mvexpand ReconnectedDetails 
| where match(ReconnectedDetails, ReconnectedTime) 
| fields ReconnectedTime, ReconnectedDetails
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...