Splunk Search

Search for events that have only specific multiple values in a field

RowdyRodney
Engager

Hey all - I have a need to search for events in Splunk that contain two specific values in one field. I want the results to return only those events that have both values in them. I'm trying to use this:

(my_field_name="value1" AND my_field_name="value2")

This still returns results that have either value1, or value2, not events that contain both. How would I query for results that contain only both values, not individual values?

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

That doesn't sound right - are you referring to a multi-value field?

| makeresults
| fields - _time
| eval value=split("ABC","")
| search value=A AND value=C

This search above will find a result for A and C, but if you change it to A and D it does not find results.

Can you give an example of your results in the OR case

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you want for value to contain only those two values, you could modify @bowesmana 's solution like so

| makeresults
| fields - _time
| eval value=split("ABC","")
| where mvcount(value)=2
| search value=A AND value=C
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...