Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Nested case -> match within mvjoin
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello, I'm trying to create an multi-value field 'category' which takes its value from a 'case(match(' that queries a users AD group membership and returns the category value based on the memberOf field; see below.
... | eval category=mvjoin(case(match(memberOf, "(?i)^.*?CN\={employee AD group}\,?.+"),"employee",match(memberOf, "(?i)^.*?CN\={domain admins AD group}\,?.+"),"privileged",match(memberOf, "(?i)^.*?CN\={restricted internet AD group}\,?.+"),"rest_int"), "|")
For some reason though the final 'category' field only ever contains one value, despite some users being in more than one of the AD groups. mvappend doesn't work either.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Not to worry folks, I just did it this way...
| eval cat1=case(match(memberOf, "(?i)^.?CN={employee AD group}\,?.+"),"employee")
| eval cat2=case(match(memberOf, "(?i)^.?CN={domain admins AD group}\,?.+"),"privileged")
| eval cat3=case(match(memberOf, "(?i)^.*?CN={restricted internet AD group}\,?.+"),"rest_int")
| eval category=mvappend(cat1,cat2,cat3)
A bit more convoluted than I'd hoped but it works.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Not to worry folks, I just did it this way...
| eval cat1=case(match(memberOf, "(?i)^.?CN={employee AD group}\,?.+"),"employee")
| eval cat2=case(match(memberOf, "(?i)^.?CN={domain admins AD group}\,?.+"),"privileged")
| eval cat3=case(match(memberOf, "(?i)^.*?CN={restricted internet AD group}\,?.+"),"rest_int")
| eval category=mvappend(cat1,cat2,cat3)
A bit more convoluted than I'd hoped but it works.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You should at least UpVote @richgalloway because he lead you directly to the answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The case command only matches once so there will only be a single value to pass to mvjoin.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ah okay, thanks.
Any suggestions on how I can accomplish my goal?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
