Splunk Dev

How do I compare numerical values in a multivalue field to another field?

abulco01
Explorer

Suppose I have some numerical field A, and some numerical multivalue field, mv_B.

Suppose I want to find all values in mv_B that are greater than A.

I envision something like the following:

search...
| eval mv_Results=mvfilter(mv_B > A)

However, this does NOT work. The documentation states the following:

mvfilter(X)
This function filters a multivalue field based on an arbitrary Boolean expression X. The Boolean expression X can reference ONLY ONE field at a time.

Hence, the above code will not work, but the following code would.

search...
| eval mv_Results=mvfilter(mv_B > 10)

In short, what is the best way to accomplish this task? I've tried searching the community answers to no avail. Is there a practical solution?

0 Karma
1 Solution

vnravikumar
Champion

Hi @abulco01

Please try

| makeresults 
| eval a="23" 
| eval b="22,23,24,24,25" 
| makemv delim="," b 
| mvexpand b 
| eval result=if(b>a,b,null()) 
| stats values(a) as a list(b) as b values(result) as result

View solution in original post

0 Karma

vnravikumar
Champion

Hi @abulco01

Please try

| makeresults 
| eval a="23" 
| eval b="22,23,24,24,25" 
| makemv delim="," b 
| mvexpand b 
| eval result=if(b>a,b,null()) 
| stats values(a) as a list(b) as b values(result) as result
0 Karma

abulco01
Explorer

Hello @vnravikumar

Thanks for the reply! Is there any way to accomplish this without the use of mvexpand?
The reason I ask is because, if I have multiple multivalue fields m1, m2, ... mn which I need to compare against, the number of rows will grow rapidly.

0 Karma

Nassima_0
New Member

Hello,

I have the same need ( comparing a multivalued numercial field with a single value ) but without using the command mvexpand.

is there any other solution ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...