Excuse me,
I have a data like this:
index=test, product=a, category="1";"3";"6",.....
how do I set the multi fields to search "3" "6"?
thanks!
None of the mv/kv stuff works because the auto field extraction code stops interpreting category's value after the 2nd quote, so it looks like this:
category="1" ;"3";"6"
None of the multivalue suggestions by other users will work because the 'category' field only has a value of "1". You need to pullout the values yourself. You'll need to do something like this. It's a little ugly but totally doable...
index=test product=a category (3 OR 6) | rex "category=(?<catvals>\S+)" | rex max_match=1000 field=catvals "(?<mvcatvals>\d+)" | search mvcatvals=3 OR mvcatvals=6
I'll explain. First, search for events that have a 3 or 6. Then use 'rex' pull out the string values like "1";"3";"6", into the 'catvals' field. Then use 'rex' to pull out the numbers 1,3,6 into a multivalued field, 'mvcatvals'. Finally, filter on it mvcatvals for 3 OR 6.
You can play with things and see what's going on, by running this search in the ui.
| stats count | eval fakeraw = "foo category=\"1\";\"3\";\"6\" foo" | rex field=fakeraw "category=(?<catvals>\S+)" | rex max_match=1000 field=catvals "(?<mvcatvals>\d+)"
(the "|stats count" nonsense is just to make a dummy event with no data).
None of the mv/kv stuff works because the auto field extraction code stops interpreting category's value after the 2nd quote, so it looks like this:
category="1" ;"3";"6"
None of the multivalue suggestions by other users will work because the 'category' field only has a value of "1". You need to pullout the values yourself. You'll need to do something like this. It's a little ugly but totally doable...
index=test product=a category (3 OR 6) | rex "category=(?<catvals>\S+)" | rex max_match=1000 field=catvals "(?<mvcatvals>\d+)" | search mvcatvals=3 OR mvcatvals=6
I'll explain. First, search for events that have a 3 or 6. Then use 'rex' pull out the string values like "1";"3";"6", into the 'catvals' field. Then use 'rex' to pull out the numbers 1,3,6 into a multivalued field, 'mvcatvals'. Finally, filter on it mvcatvals for 3 OR 6.
You can play with things and see what's going on, by running this search in the ui.
| stats count | eval fakeraw = "foo category=\"1\";\"3\";\"6\" foo" | rex field=fakeraw "category=(?<catvals>\S+)" | rex max_match=1000 field=catvals "(?<mvcatvals>\d+)"
(the "|stats count" nonsense is just to make a dummy event with no data).
Try this one:
| makemv delim=";" category | mvexpand category | search category="3" OR category="6"
I have tried this, but it fail to search multi values, just show category="3" or "6"
I need to search all have 3 or 6.
Something like this might work:
| makemv delim=";" category | search category="\"3"\" category="\"6"\"