Suppose I have some numerical field A , and some numerical multivalue field, mv_B .
Suppose I want to find all values in mv_B that are greater than A .
I envision something like the following:
search...
| eval mv_Results=mvfilter(mv_B > A)
However, this does NOT work. The documentation states the following:
mvfilter(X)
This function filters a multivalue field based on an arbitrary Boolean expression X. The Boolean expression X can reference ONLY ONE field at a time.
Hence, the above code will not work, but the following code would.
search...
| eval mv_Results=mvfilter(mv_B > 10)
In short, what is the best way to accomplish this task? I've tried searching the community answers to no avail. Is there a practical solution?
... View more