Splunk Search

how to use mvfilter to find out three or more evals?

90509
Engager

suppose my search like this
| eval A1=mvindex(mvfilter(a1="1" OR a2="2" OR a3="3")
| eval B1=mvindex(mvfilter(b1="1" OR b2="2" OR b3="3")
| eval C1=mvindex(mvfilter(c1="1" OR c2="2" OR c3="3")
so here how to filter A1,B1,C1 ?
| eval D=mvfilter( A OR B1 OR C1 ) is it correct? if I enter this it's showing error.
please tell me answer

Tags (1)
0 Karma

FrankVl
Ultra Champion

Can you please elaborate what your data looks like and what you actually want to achieve?

Also: your first 3 eval statements are incomplete (the mvindex function is missing its second argument and closing parenthesis).

Also: please post search code as code, using the 101010 button in the editor, to make it easier to read.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...