Splunk Search

Splunk search returning where field equals one value only

kishan2356
Explorer

I have a field called alphabet that stores multiple values. I want to create a search that only returns events that has only one of those values. In this example I want to return all events where only field = A exists

Event examples

'index = test WHERE alphabet=a' does not work as it returns all events where 'a' exists including with other values.

For the three events below I would like a search that only returns event 3. How can I build a search that does this?

Event 1 

alphabet = a,b,c,d

 

Event 2

alphabet = a,b

 

Event 3

alphabet = a

 

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Not sure that your stated problem makes sense. If you have a field 'alphabet' which has one of those 3 values, where the field is a SINGLE value field of either 'a', 'a,b' or 'a,b,c,d' then the Splunk command

index=foo alphabet=a 

will only find the event where alphabet is ONLY a

| makeresults 
| eval alphabet=split("a,b,c,d:a,b:a",":")
| mvexpand alphabet
| search alphabet=a

whereas if your field alphabet is a MULTIVALUE field that has those values, then it will find all values, e.g.

| makeresults 
| eval alphabet=split("a,b,c,d:a,b:a",":")
| mvexpand alphabet
| eval alphabet=split(alphabet,",")
| search alphabet=a

Your SPL 'index=test WHERE ... ' - That is specifying a search term WHERE, not doing a conditional clause | where.

The Splunk 'search' command will do string matching on the value, so alphabet=a should only find 'a' and alphabet=*a* would find all. 

Using the Splunk 'where' command it can then do much more, e.g.

| where match(alphabet,"^a$")

or even just

| where alphabet="a"

but again - SINGLE and MULTIVALUE fields will behave differently, in that BOTH those will match the MULTIVALUE field where ONE of the values is 'a'.

Hope this helps

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use additional commands to filter the initial results down to the desired ones.  I like regex.

index = test WHERE alphabet=a
| regex alphabet="^a$"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...