Splunk Search

How do I Search a Multi-Value Field?

atebysandwich
Path Finder

I need to search a field called DNS_Matched, that has multi-value fields, for events that have one or more values that meet the criteria of the value ending with -admin, -vip, -mgt, or does not meet any of those three. How can I do that? 

Example 

DNS_Matched
host1
host1-vip
host1-mgt
host2 
host2-admin
host2-mgmt
host2-vip
Labels (6)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

To work with multi-value fields, look to the mv* functions.

| eval match=if(isnotnull(mvfind(DNS_Matched, "(-admin|-mgt|-vip)")),1, 0)

The mvfind function uses a regular expression to search an MV field for certain text.  It returns NULL if the value is not found or an index into the field if it is found.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

To work with multi-value fields, look to the mv* functions.

| eval match=if(isnotnull(mvfind(DNS_Matched, "(-admin|-mgt|-vip)")),1, 0)

The mvfind function uses a regular expression to search an MV field for certain text.  It returns NULL if the value is not found or an index into the field if it is found.

---
If this reply helps you, Karma would be appreciated.

atebysandwich
Path Finder

This helped a lot. Thank you!

 

Tags (1)
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...