Splunk Search

How do I Search a Multi-Value Field?

atebysandwich
Path Finder

I need to search a field called DNS_Matched, that has multi-value fields, for events that have one or more values that meet the criteria of the value ending with -admin, -vip, -mgt, or does not meet any of those three. How can I do that? 

Example 

DNS_Matched
host1
host1-vip
host1-mgt
host2 
host2-admin
host2-mgmt
host2-vip
Labels (6)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

To work with multi-value fields, look to the mv* functions.

| eval match=if(isnotnull(mvfind(DNS_Matched, "(-admin|-mgt|-vip)")),1, 0)

The mvfind function uses a regular expression to search an MV field for certain text.  It returns NULL if the value is not found or an index into the field if it is found.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

To work with multi-value fields, look to the mv* functions.

| eval match=if(isnotnull(mvfind(DNS_Matched, "(-admin|-mgt|-vip)")),1, 0)

The mvfind function uses a regular expression to search an MV field for certain text.  It returns NULL if the value is not found or an index into the field if it is found.

---
If this reply helps you, Karma would be appreciated.

atebysandwich
Path Finder

This helped a lot. Thank you!

 

Tags (1)
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...