Trying to find if at least one value of a multivalue field matches another field

[cafissimo]

Hello,
I am trying to figure out how to check if inside a list of paths that are inside a multivalue field there is one that matches another field.

For example

event_field=/opt/aaa/bbb/ccc
multivalue_field=/tmp/aaa/zzz ; /var/log/syslog; /opt/aaa/bbb ; /lb/tools/java

In the above example the third value of the multivalue_field matches the event_field, because /opt/aaa/bbb is part of event_field.
It would be nice not to use mvexpand...

Thanks in advance.

[javiergn]

Is there any reason you don't want to use mvexpand? It becomes quite tricky without it as far as I can think of.
Give the following code a code and let me know if that performs well or you really want to avoid mvexpand at all cost.

your base search
| mvexpand multivalue_field
| eval find_match = if(match(event_field, multivalue_field), 1, 0)
| stats values(event_field) as event_field, values(multivalue_field) as multivalue_field, max(find_match) as find_match

You could use mvfilter but then you need a way to hardcode the value of the path you are looking for as it won't take two variables as arguments:

your base search
| eval is_match = mvfilter(match("/opt/aaa/bbb/ccc", multivalue_field))

[sundareshr]

Not sure you need the mvexpand. Try without, should work just as well.

your base search
 | eval find_match = if(match(event_field, multivalue_field), 1, 0)

[javiergn]

I'm afraid it doesn't.

| stats count | fields - count
| eval event_field="/opt/aaa/bbb/ccc"
| eval multivalue_field="/tmp/aaa/zzz ; /var/log/syslog ; /opt/aaa/bbb ; /lb/tools/java"
| eval multivalue_field = split(multivalue_field, " ; ")
| eval find_match = if(match(event_field, multivalue_field), 1, 0)

find_match = 0

[sundareshr]

That's interesting, is it becuase of the /?

 | stats count | fields - count
 | eval aevent_field="ccc"
 | eval amultivalue_field="aaa; bbb; ccc; ddd"
 | eval amultivalue_field=split(amultivalue_field, ";")
 | eval afind_match = if(match(amultivalue_field, aevent_field), 1, 0)
 | eval bevent_field="/opt/aaa/bbb/ccc"
 | eval bmultivalue_field="/tmp/aaa/zzz ; /var/log/syslog ; /opt/aaa/bbb ; /lb/tools/java"
 | eval bmultivalue_field = split(bmultivalue_field, " ; ")
 | eval bfind_match = if(match(bmultivalue_field, bevent_field), 1, 0)

find_match=1

*BTW, do you have multivalue_field & event_field flipped? match(SUBJECT, "REGEX")

[javiergn]

Could be because of the /, not sure.
With regards to your second question, I have swapped the arguments in purpose because '/opt/aaa/bbb' superseeds '/opt/aaa/bbb/ccc'

| stats count | fields - count
| eval event_field="/opt/aaa/bbb/ccc"
| eval multivalue_field="/opt/aaa/bbb"
| eval find_match1 = if(match(event_field, multivalue_field), 1, 0)
| eval find_match2 = if(match(multivalue_field,event_field), 1, 0)

If the regex is more specific than the subject, it won't capture it:

| stats count | fields - count
| eval child="AAAAAAAAAAAAAAAAAAAA"
| eval parent="AA"
| eval find_match1 = if(match(child, parent), 1, 0)
| eval find_match2 = if(match(parent,child), 1, 0)