Splunk Search

search values inside MV

hok2010
New Member

Hello All,

i need a help in creating report

i have a mv field called "report", i want to search for values so they return me the result.
i tried with "IN function" , but it is returning me any values inside the function.
to be particular i need those values in mv field

for example, i have two fields manager and report, report having mv fields

manger------------------------ report
john ------------------ day1
------------------ day2
------------------ day3

------------------ day4

kevin -------------- day1
------------------ day4
index="my search" | where in(report,"day1","day4")

so here i'm expecting only results for kevin

i dont want to mv index it into multiple fields!

0 Karma
1 Solution

askkawalkar
Path Finder

Hi @hok2010 ,

You can use additionally mvcount function in where condition

Please try below run anywhere query-

   | makeresults 
     | eval data="john|day1,day2,day3,day4;Kevin|day1,day2;" 
     | makemv data delim=";" 
     | mvexpand data 
     | makemv data delim="|" 
     | eval Manager=mvindex(data,0),report=mvindex(data,1)
    | makemv report delim=","
    | fields Manager,report
    | where in(report,"day1","day2") and mvcount(report)=2

Thanks

View solution in original post

askkawalkar
Path Finder

Hi @hok2010 ,

You can use additionally mvcount function in where condition

Please try below run anywhere query-

   | makeresults 
     | eval data="john|day1,day2,day3,day4;Kevin|day1,day2;" 
     | makemv data delim=";" 
     | mvexpand data 
     | makemv data delim="|" 
     | eval Manager=mvindex(data,0),report=mvindex(data,1)
    | makemv report delim=","
    | fields Manager,report
    | where in(report,"day1","day2") and mvcount(report)=2

Thanks

arjunpkishore5
Motivator

Have you tried | search report IN ("day1", "day4")

0 Karma

hok2010
New Member

hi arjun,
it didnt work well im getting the same results

0 Karma
Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...