Note my response and included command would do this and more with 5/6 less commands in an inexpensive manner. ... View more

@GindiKhangura    Not sure if your old listed version of Splunk 7.2.6 can support it, hoping you've updated since its unsupported as of April 2021 and this thread is just over a year old at my time of writing. I'm writing because I never saw the appropriate answer added.  Since your CSC is a streaming command, you can set a replication whitelist in  $SPLUNK_HOME/etc/apps/app_name/default/distsearch.conf to include the required libraries. This will allow your indexers to have a copy, fixing the error, and removing any need for the inappropriate copying of splunklib into the bin directory. https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/packageanddeploycustom/#Deploy-a-streaming-command-on-an-indexer Happy Holidays and Happy Splunking ... View more

Try something made to give you a comparison of multivalue fields and can return a multivalue field of the intersecting values.   MVCompare | Splunkbase ... View more

MVCompare | Splunkbase ... View more

The given information works, but I would consider something that is more direct: MVCompare | Splunkbase ... View more

I would recommend a more direct approach using something meant to solve the issue without extra SPL such as parsing, expanding, etc.   Additionally, while the given accepted answer provides a solution to your particular use case in that you just need a yes/no to the existence of overlapping values. A command such as this one could also provide you with what those values actually are.   MVCompare | Splunkbase ... View more