Hello,
Working with Splunk 7.3.2.
I have two multivalues that have a set of values in common:
| makeresults
| eval A="a,b,c,d,e,f,g,h,i,j", B="d,h,j,l,o,t,z"
| table A B
| makemv A delim=",...
See more...
Hello,
Working with Splunk 7.3.2.
I have two multivalues that have a set of values in common:
| makeresults
| eval A="a,b,c,d,e,f,g,h,i,j", B="d,h,j,l,o,t,z"
| table A B
| makemv A delim=","
| makemv B delim=","
In this case the common values are d, h, j . What I'd like to do is create a new multivalue containing those values. The following search gets the job done, but it seems like a terrible way of doing so:
| makeresults
| eval A="a,b,c,d,e,f,g,h,i,j", B="d,h,j,l,o,t,z"
| table A B
| makemv A delim=","
| makemv B delim=","
| eval C = mvappend(A,B)
| table C
| mvexpand C
| eventstats count by C
| where count > 1
| dedup C
| stats values(C) as C
Can somebody give me some pointers/suggestions on how to make it more elegant and less resource consuming?
Thanks!
Andrew