HI everyone,
the filed containst two values. one in each line.
fieldname = value1
value2
How can we exlude the results with the fieldname contains value2.
@rashid47010
Can you please try this?
YOUR_SEARCH | where isnull(mvfind(fieldname,"value2"))
My Sample Search:
| makeresults | eval fieldname="value1,value2" | append [| makeresults | eval fieldname="value1,value3"] | eval fieldname = split(fieldname,",") | where isnull(mvfind(fieldname,"value2"))
Thanks