extract multi valued field

[rashid47010]

HI everyone,

the filed containst two values. one in each line.

fieldname = value1
value2

How can we exlude the results with the fieldname contains value2.

[kamlesh_vaghela]

@rashid47010
Can you please try this?

YOUR_SEARCH | where isnull(mvfind(fieldname,"value2"))

My Sample Search:

| makeresults | eval fieldname="value1,value2" | append [| makeresults | eval fieldname="value1,value3"] | eval fieldname = split(fieldname,",") | where isnull(mvfind(fieldname,"value2"))

Thanks