How to search and filter based on values matched in an eval case statement?

[splunker1981]

Hello all,

Trying to figure out how to search or filter based on the matches in my case statement. I guess also want to figure out if this is the correct way to approach this search.

searchHere |  eval status=case(ship=_pro, "processed", ship=_ma, "sent") | stats values(field1), values(field2), values(filed3), values(status) by fieldx 

Now, I want to search the contents of the values() function for only those that contain both strings matched in my case statement. I can't focus on a count because there are many other variations that could potentially match and thus making the count >1. Something like "if the field status contains the values: processed AND sent" in any order show me those events.

Thanks for the help in advance.

[somesoni2 · Accepted solution]

This should do it

Updated (replaced mvfind with mvfilter)

 searchHere |  eval status=case(ship=_pro, "processed", ship=_ma, "sent") | stats values(field1), values(field2), values(filed3), values(status) as status by fieldx | where isnotnull(mvfilter(match(status,"processed"))) AND isnotnull(mvfilter(match(status,"sent")))

[splunker1981]

Thanks for the help. I ran the search above and get the following error:
Error in 'where' command: The arguments to the 'mvfind' function are invalid.

I don't see anything referencing mvfind(match in the docs. Is that just saying match for the value in fieldx? Did you mean to use mvfilter? I tried that and that seems to return just the values I'm searching for.

[somesoni2]

Oops..wrong function used. Try the updated answer.

[splunker1981]

thanks for the help, that did the trick!

[sowings]

When you use values(), the resultant field is multi-value. This means it can have several values simultaneously. Testing for "this and that" is as simple as "mv_field=<value1> mv_field=<value2>" (the AND in between is implied). It might benefit you to use an "AS ..." clause in the stats call to rename the field to something easier to manage.

[sundareshr]

Try this

searchHere (ship="_pro" OR ship="_ma"|  eval status=case(ship=_pro, "processed", ship=_ma, "sent") | stats values(field1), values(field2), values(filed3), values(status) by fieldx 

*OR*

searchHere |  eval status=case(ship=_pro, "processed", ship=_ma, "sent", 1=1, "other") | search status="processed" OR status="sent" | stats values(field1), values(field2), values(filed3), values(status) by fieldx 

[splunker1981]

Thanks for the reply, but the second search will match on EITHER/OR value. I only want to show results where BOTH values exists. Same issue with the first search, gives me either/or one or the other value.