Splunk Search

search values inside MV

hok2010
New Member

Hello All,

i need a help in creating report

i have a mv field called "report", i want to search for values so they return me the result.
i tried with "IN function" , but it is returning me any values inside the function.
to be particular i need those values in mv field

for example, i have two fields manager and report, report having mv fields

manger------------------------ report
john ------------------ day1
------------------ day2
------------------ day3

------------------ day4

kevin -------------- day1
------------------ day4
index="my search" | where in(report,"day1","day4")

so here i'm expecting only results for kevin

i dont want to mv index it into multiple fields!

0 Karma
1 Solution

askkawalkar
Path Finder

Hi @hok2010 ,

You can use additionally mvcount function in where condition

Please try below run anywhere query-

   | makeresults 
     | eval data="john|day1,day2,day3,day4;Kevin|day1,day2;" 
     | makemv data delim=";" 
     | mvexpand data 
     | makemv data delim="|" 
     | eval Manager=mvindex(data,0),report=mvindex(data,1)
    | makemv report delim=","
    | fields Manager,report
    | where in(report,"day1","day2") and mvcount(report)=2

Thanks

View solution in original post

askkawalkar
Path Finder

Hi @hok2010 ,

You can use additionally mvcount function in where condition

Please try below run anywhere query-

   | makeresults 
     | eval data="john|day1,day2,day3,day4;Kevin|day1,day2;" 
     | makemv data delim=";" 
     | mvexpand data 
     | makemv data delim="|" 
     | eval Manager=mvindex(data,0),report=mvindex(data,1)
    | makemv report delim=","
    | fields Manager,report
    | where in(report,"day1","day2") and mvcount(report)=2

Thanks

arjunpkishore5
Motivator

Have you tried | search report IN ("day1", "day4")

0 Karma

hok2010
New Member

hi arjun,
it didnt work well im getting the same results

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...