Splunk Search

Match Substring in Multivalue field and return only the matched substring values

vn_g
Path Finder
ReconnectedTimeReconnectedDetails
2021-02-02T16:46:19.0002021-02-02T08:54:48.000|viceusr|0xA310B|BEK-329999910922|11.188.92.6
2021-02-02T09:29:59.000|shuani|0xF2C223|NTIC4|1.273.6.189
2021-02-02T16:46:19.000|scrmp_install|0x4216DA|GLB163|21.1.218.15
2021-02-02T08:54:48.000
2021-02-02T09:29:59.000
2021-02-02T08:54:48.000|viceusr|0xA310B|BEK-329999910922|11.188.92.6
2021-02-02T09:29:59.000|shuani|0xF2C223|NTIC4|1.273.6.189
2021-02-02T16:46:19.000|scrmp_install|0x4216DA|GLB163|21.1.218.15

 

Both ReconnectedTime and ReconnectedDetails are multivalue fields. In each event the "ReconnectedTime" value [ substring which needs to be valuated ] exists in "ReconnectedDetails" then only the matched substring values of ReconnectedDetails should be the final Ouput.

ReconnectedTimeReconnectedDetails
2021-02-02T16:46:19.0002021-02-02T16:46:19.000|scrmp_install|0x4216DA|GLB163|21.1.218.15
2021-02-02T08:54:48.000
2021-02-02T09:29:59.000
2021-02-02T08:54:48.000|viceusr|0xA310B|BEK-329999910922|11.188.92.6
2021-02-02T09:29:59.000|shuani|0xF2C223|NTIC4|1.273.6.189
0 Karma
1 Solution

manjunathmeti
Champion

ok, try this if you don't want to group: 

<your_base_search>
| mvexpand ReconnectedTime 
| mvexpand ReconnectedDetails 
| where match(ReconnectedDetails, ReconnectedTime) 
| fields ReconnectedTime, ReconnectedDetails

View solution in original post

manjunathmeti
Champion

hi @vn_g ,

Try this:

 

<your_base_search>
| eval ReconnectedTime_orig=ReconnectedTime 
| nomv ReconnectedTime_orig
| mvexpand ReconnectedTime 
| mvexpand ReconnectedDetails 
| where match(ReconnectedDetails, ReconnectedTime) 
| stats values(ReconnectedTime) as ReconnectedTime values(ReconnectedDetails) as ReconnectedDetails by ReconnectedTime_orig 
| fields ReconnectedTime, ReconnectedDetails

 

0 Karma

vn_g
Path Finder

No the output is not as expected. All 3 values of "Reconnected Details" are being displayed for each "ReconnectedTime". Only the sub string value of ReconnectedTime in Reconnected Details should be displayed for Reconnected Details.

 

0 Karma

manjunathmeti
Champion

ok, try this if you don't want to group: 

<your_base_search>
| mvexpand ReconnectedTime 
| mvexpand ReconnectedDetails 
| where match(ReconnectedDetails, ReconnectedTime) 
| fields ReconnectedTime, ReconnectedDetails
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...