Splunk Search

How to use mvfilter to get list of data that contain less and only less than the specific data?

limalbert
Path Finder

Hi all,

I have a question related to my other question.

https://answers.splunk.com/answers/518074/how-to-get-a-count-of-stats-list-that-contains-a-s.html

Boundary: date and user. There are at least 1000 data. Sample example below.

Date User list(data)
3/31/17 user1 1, 2
3/31/17 user2 1, 5
3/31/17 user3 2, 10

Current search:
your current search giving Date User list(data)
| where isnotnull(mvfilter('list(data)'<3))
| chart count(user) by date

Let say I want to count user who have list(data) that contains number less and only less than "3". Then, the user count answer should be "1". Using the query above, I am getting result of "3". I tried adding "!> 2", but it won't run.

Eventually, I want to make side by side comparison between count(user) with list of data >3, and count of user with list of data less and only less than 3.

0 Karma
1 Solution

somesoni2
Revered Legend

Do like this. Inverted the conditions. Basically you want to count events where list(data) only contains values < 3. For that, we try to find events where list(data) has values greater than 3, if it's null (no value is greater than 3) then it'll be counted.

your current search giving Date User list(data)
| where isnull(mvfilter('list(data)'>3))
| chart count(user) by date

View solution in original post

somesoni2
Revered Legend

Do like this. Inverted the conditions. Basically you want to count events where list(data) only contains values < 3. For that, we try to find events where list(data) has values greater than 3, if it's null (no value is greater than 3) then it'll be counted.

your current search giving Date User list(data)
| where isnull(mvfilter('list(data)'>3))
| chart count(user) by date

limalbert
Path Finder

You are the best!
Where do you find documentation for isnull and isnotnull? Seriously couldn't find it.

0 Karma

somesoni2
Revered Legend

Below link give details of all the functions that you can use with eval and where commands.

docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...