Splunk Search

Search for events that have only specific multiple values in a field

RowdyRodney
New Member

Hey all - I have a need to search for events in Splunk that contain two specific values in one field. I want the results to return only those events that have both values in them. I'm trying to use this:

(my_field_name="value1" AND my_field_name="value2")

This still returns results that have either value1, or value2, not events that contain both. How would I query for results that contain only both values, not individual values?

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

That doesn't sound right - are you referring to a multi-value field?

| makeresults
| fields - _time
| eval value=split("ABC","")
| search value=A AND value=C

This search above will find a result for A and C, but if you change it to A and D it does not find results.

Can you give an example of your results in the OR case

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you want for value to contain only those two values, you could modify @bowesmana 's solution like so

| makeresults
| fields - _time
| eval value=split("ABC","")
| where mvcount(value)=2
| search value=A AND value=C
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...