Splunk Search

How to use mvfilter to get list of data that contain less and only less than the specific data?

limalbert
Path Finder

Hi all,

I have a question related to my other question.

https://answers.splunk.com/answers/518074/how-to-get-a-count-of-stats-list-that-contains-a-s.html

Boundary: date and user. There are at least 1000 data. Sample example below.

Date User list(data)
3/31/17 user1 1, 2
3/31/17 user2 1, 5
3/31/17 user3 2, 10

Current search:
your current search giving Date User list(data)
| where isnotnull(mvfilter('list(data)'<3))
| chart count(user) by date

Let say I want to count user who have list(data) that contains number less and only less than "3". Then, the user count answer should be "1". Using the query above, I am getting result of "3". I tried adding "!> 2", but it won't run.

Eventually, I want to make side by side comparison between count(user) with list of data >3, and count of user with list of data less and only less than 3.

0 Karma
1 Solution

somesoni2
Revered Legend

Do like this. Inverted the conditions. Basically you want to count events where list(data) only contains values < 3. For that, we try to find events where list(data) has values greater than 3, if it's null (no value is greater than 3) then it'll be counted.

your current search giving Date User list(data)
| where isnull(mvfilter('list(data)'>3))
| chart count(user) by date

View solution in original post

somesoni2
Revered Legend

Do like this. Inverted the conditions. Basically you want to count events where list(data) only contains values < 3. For that, we try to find events where list(data) has values greater than 3, if it's null (no value is greater than 3) then it'll be counted.

your current search giving Date User list(data)
| where isnull(mvfilter('list(data)'>3))
| chart count(user) by date

limalbert
Path Finder

You are the best!
Where do you find documentation for isnull and isnotnull? Seriously couldn't find it.

0 Karma

somesoni2
Revered Legend

Below link give details of all the functions that you can use with eval and where commands.

docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...