Splunk Search

Multivalue Field Filterung search

mklhs
Path Finder

Hello,

I need your help.
I have a field which contains multivalue.
Example:
Table


Foo


in cash


foo
in cash


I need a way to only display events that have foo and bar in this field. I tried to count the values and filter them accordingly but it doesn't work.

0 Karma
1 Solution

renjith_nair
Legend

@mklhs ,

Try

your search |where isnotnull(mvfind(field_name,"foo")) AND isnotnull(mvfind(field_name,"bar"))

Please note that the argument to mvfind is REGEX . So based on your field value, you may combine that with regex as well

Reference : https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/MultivalueEvalFunctions#mvfind.28...

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@mklhs ,

Try

your search |where isnotnull(mvfind(field_name,"foo")) AND isnotnull(mvfind(field_name,"bar"))

Please note that the argument to mvfind is REGEX . So based on your field value, you may combine that with regex as well

Reference : https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/MultivalueEvalFunctions#mvfind.28...

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...