Splunk search returning where field equals one value only

[kishan2356]

I have a field called alphabet that stores multiple values. I want to create a search that only returns events that has only one of those values. In this example I want to return all events where only field = A exists

Event examples

'index = test WHERE alphabet=a' does not work as it returns all events where 'a' exists including with other values.

For the three events below I would like a search that only returns event 3. How can I build a search that does this?

Event 1 

alphabet = a,b,c,d

Event 2

alphabet = a,b

Event 3

alphabet = a

[bowesmana]

Not sure that your stated problem makes sense. If you have a field 'alphabet' which has one of those 3 values, where the field is a SINGLE value field of either 'a', 'a,b' or 'a,b,c,d' then the Splunk command

index=foo alphabet=a 

will only find the event where alphabet is ONLY a

| makeresults 
| eval alphabet=split("a,b,c,d:a,b:a",":")
| mvexpand alphabet
| search alphabet=a

whereas if your field alphabet is a MULTIVALUE field that has those values, then it will find all values, e.g.

| makeresults 
| eval alphabet=split("a,b,c,d:a,b:a",":")
| mvexpand alphabet
| eval alphabet=split(alphabet,",")
| search alphabet=a

Your SPL 'index=test WHERE ... ' - That is specifying a search term WHERE, not doing a conditional clause | where.

The Splunk 'search' command will do string matching on the value, so alphabet=a should only find 'a' and alphabet=*a* would find all. 

Using the Splunk 'where' command it can then do much more, e.g.

| where match(alphabet,"^a$")

or even just

| where alphabet="a"

but again - SINGLE and MULTIVALUE fields will behave differently, in that BOTH those will match the MULTIVALUE field where ONE of the values is 'a'.

Hope this helps

[richgalloway]

Use additional commands to filter the initial results down to the desired ones.  I like regex.

index = test WHERE alphabet=a
| regex alphabet="^a$"