Search for events that have only specific multiple values in a field

[RowdyRodney]

Hey all - I have a need to search for events in Splunk that contain two specific values in one field. I want the results to return only those events that have both values in them. I'm trying to use this:

(my_field_name="value1" AND my_field_name="value2")

This still returns results that have either value1, or value2, not events that contain both. How would I query for results that contain only both values, not individual values?

[bowesmana]

That doesn't sound right - are you referring to a multi-value field?

| makeresults
| fields - _time
| eval value=split("ABC","")
| search value=A AND value=C

This search above will find a result for A and C, but if you change it to A and D it does not find results.

Can you give an example of your results in the OR case

[ITWhisperer]

If you want for value to contain only those two values, you could modify @bowesmana 's solution like so

| makeresults
| fields - _time
| eval value=split("ABC","")
| where mvcount(value)=2
| search value=A AND value=C