Splunk Search

search values inside MV

hok2010
New Member

Hello All,

i need a help in creating report

i have a mv field called "report", i want to search for values so they return me the result.
i tried with "IN function" , but it is returning me any values inside the function.
to be particular i need those values in mv field

for example, i have two fields manager and report, report having mv fields

manger------------------------ report
john ------------------ day1
------------------ day2
------------------ day3

------------------ day4

kevin -------------- day1
------------------ day4
index="my search" | where in(report,"day1","day4")

so here i'm expecting only results for kevin

i dont want to mv index it into multiple fields!

0 Karma
1 Solution

askkawalkar
Path Finder

Hi @hok2010 ,

You can use additionally mvcount function in where condition

Please try below run anywhere query-

   | makeresults 
     | eval data="john|day1,day2,day3,day4;Kevin|day1,day2;" 
     | makemv data delim=";" 
     | mvexpand data 
     | makemv data delim="|" 
     | eval Manager=mvindex(data,0),report=mvindex(data,1)
    | makemv report delim=","
    | fields Manager,report
    | where in(report,"day1","day2") and mvcount(report)=2

Thanks

View solution in original post

askkawalkar
Path Finder

Hi @hok2010 ,

You can use additionally mvcount function in where condition

Please try below run anywhere query-

   | makeresults 
     | eval data="john|day1,day2,day3,day4;Kevin|day1,day2;" 
     | makemv data delim=";" 
     | mvexpand data 
     | makemv data delim="|" 
     | eval Manager=mvindex(data,0),report=mvindex(data,1)
    | makemv report delim=","
    | fields Manager,report
    | where in(report,"day1","day2") and mvcount(report)=2

Thanks

arjunpkishore5
Motivator

Have you tried | search report IN ("day1", "day4")

0 Karma

hok2010
New Member

hi arjun,
it didnt work well im getting the same results

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...