Splunk Search

multivalue fields

poladbank
New Member

Hi I'm trying to count the number of times of a specific values "not match" exist in a multi-value field, search for events where this value appears more then once.

add an example

nameCheckID

aaa-1
bbb-2
ccc-3

not match
match
match
6564
ddd-1
eee-2
fff-3
not match
match
not match
7875

 

because in the lower row the value "not match" exist more then 1 time (>1).
I don't found a suitable command.
would appreciate  help:)

Labels (2)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| chart values(name) as name count by ID Check
| where 'count: not match' > 1
| rename "name: not match" as name, "count: not match" as count
| table ID name count
0 Karma

poladbank
New Member

Thank you for your fast response!
I've tried your solution and had a problem in the where part.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...