Dears,
I would like to search and show a string in the field that contains multiples values. Ex.: In the IP field, there are multiples IPs as below :
IP field
10.XXX.XXX.XXX 200.XXX.XXX.XXX
I would like to search only IPs that start with "200.". Until now i've used the syntaxe "| where like(IP,"%200.%") ". But, i need to show only the IP that start with "200." to do outer join with another search.
Can you help me?
Assuming that these IP's are separated by space, you can convert them to multi valued field and then filter them for specific IP. Something like this
Your base search | makemv IP_field delim=" " | eval IP_field=mvfilter(match(IP_field,"^200\")) | ...you got your IP_field filtered with just the IP's starting with 200.
Assuming that these IP's are separated by space, you can convert them to multi valued field and then filter them for specific IP. Something like this
Your base search | makemv IP_field delim=" " | eval IP_field=mvfilter(match(IP_field,"^200\")) | ...you got your IP_field filtered with just the IP's starting with 200.
Perfect. I reproduced this orientation and it's correct.
Thanks so much.
Regards,
Fábio Augusto