CODEWITHSUNDEEP
splunksplunk-query
Yaroslav Borysiuk
Yaroslav Borysiuk

Reputation: 71

How to check if the multi-value field contains the value of the other field in Splunk

I need to set the field value according to the existence of another event field (e.g. a field) in a multivalued field of the same event (e.g. mv_field)

Here is an example query, which doesn't work as I expected, because the ext_field always has the value "value_if_true"

| ...
| eval ext_field = if(in(mv_field, field), "value_if_true", "value_if_false")
| ...

Could You please, tell me what am I doing wrong?

Thanks!

Upvotes: 3

Views: 9049

Answers (1)

Yaroslav Borysiuk
Yaroslav Borysiuk

Reputation: 71

I've found an answer on my own, believe it will help somebody;)

| ...
| eval ext_field = if(isnull(mvfind(mv_field, field)), "value_if_false", "value_if_true")
| ...

Upvotes: 4

Related Questions