Splunk mvfilter. Also you might want to do NOT Type=Success instead. Splunk mvfilter

 
 Also you might want to do NOT Type=Success insteadSplunk mvfilter This example uses the pi and pow functions to calculate the area of two circles

In the following Windows event log message field Account Name appears twice with different values. For information about using string and numeric fields in functions, and nesting functions, see Overview of SPL2 evaluation functions . A new field called sum_of_areas is created to store the sum of the areas of the two circles. pkashou. 1 Found the answer after posting this question, its just using exiting mvfilter function to pull the match resutls. Building for the Splunk Platform. 1 Karma Reply 1 Solution Solution mw Splunk Employee 05-31-2011 06:53 PM I'm not sure what the deal is with mvfind, but would this work?: search X | eval. I tried using "| where 'list (data)' >1 | chart count (user) by date" , but it gives me. 0 KarmaAuto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type. your_search Type!=Success | the_rest_of_your_search. Motivator ‎01-27. | spath input=spec path=spec. Splunk Enterprise. I have already listed them out from a comma separated value but, I'm having a hard time getting them the way I want them to display. pDNS has proven to be a valuable tool within the security community. This function removes the duplicate values from a multi-value field. Here are the pieces that are required. | eval f1split=split (f1, ""), f2split=split (f2, "") Make multi-value fields (called f1split and f2split) for each target field. you can 'remove' all ip addresses starting with a 10. You could look at mvfilter, although I haven't seen it be used to for null. First, I would like to get the value of dnsinfo_hostname field. I need to add the value of a text box input to a multiselect input. You can use this function with the eval, fieldformat, and where commands, and as part of eval expressions. Macros are prefixed with "MC-" to easily identify and look at manually. Building for the Splunk Platform. 156. This is using mvfilter to remove fields that don't match a regex. 21, the drilldown works fine; Splunk 8 gives the following error: Invalid earliest time. Refer to the screenshot below too; The above is the log for the event. Reply. 1. Or do it like this: | eval keep=mvfilter (mvnumeric>3) | where mvcount (mvnumeric)=mvcount (keep) This will remove any row which contains numbers ️ (in your data, the second row). For example: | makeresults | eval values_type=split ( "value1,value2,value1,value2,value1,value2,value1,value2,value2,value2,value2,",",") | eval values_count=mvcount (values_type) | eval value1=mvfilter (match. But in a case that I want the result is a negative number between the start and the end day. Community; Community; Splunk Answers. a. COVID-19 Response SplunkBase Developers DocumentationThis is NOT a complete answer but it should give you enough to work with to craft your own. Unless you’re joining two explicit Boolean expressions, omit the AND operator because Splunk assumes the space between any two search. We could even take action against the event in Splunk by copying it, redacting the password in the src_user field, and placing it in a summary index for further investigation. Yes, timestamps can be averaged, if they are in epoch (integer) form. Information about Splunk's directors and executive officers, including their ownership of Splunk securities, is set forth in the proxy statement for Splunk's 2023. Reply. Do I need to create a junk variable to do this?hello everyone. To break it down more. You want to create a field which is the URL minus the UserId part, And therefore the stats will be grouped by which url is called. Hello All, I am trying to make it so that when a search string returns the "No Results Found" message, it actually displays a zero. The fields of interest are username, Action, and file. Splunk Threat Research Team. Exception in thread "main" com. I am trying to add a column to my current chart which has "Customers" as one column and "Users" as another. 90. Reading the Splunk docs, the mvfind function uses a regex match, yielding the following undesirable behavior: | makeresults | eval my_multival="one,two,three". The Boolean expression can reference ONLY ONE field at a time. That's why I use the mvfilter and mvdedup commands below. don’t quote me, but I don’t think the REGEX data type in splunk can be replaced with a field value, hence the need to use a subsearch to pass an actual string there Note the value of search needs to be enclosed in " " , so you may need to do an eval before calling return to add the double quotes What we would like to do now is a: mvdistinctcount (mvfield) -> if the result is bigger than 1 we win. The problem I am facing is this search is working fine with small size events but when it comes to large events with more CLP counts. View solution in. Then, the user count answer should be "1". com is my is our internal email domain name, recipient field is the recipient of the email, either a single-valued field or a multi-valued field. Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type. Log in now. Use the mvfilter () function to filter a multivalue field using an arbitrary Boolean expression. A data structure that you use to test whether an element is a member of a set. Splunk Enterprise loads the Add Data - Select Source page. Solved: I want to calculate the raw size of an array field in JSON. Neither of these appear to work for me: y=mvfilter (isnotnull (x)) y=mvfilter (!isnull (x)) While this does: y=mvfilter (x!="NULL")) Spread our blogUsage of Splunk EVAL Function : MVDEDUP Usage of Splunk EVAL Function : MVDEDUP This function takes single argument ( X ). Here's what I am trying to achieve. I have limited Action to 2 values, allowed and denied. Allows me to get a comprehensive view of my infrastructure and helps me to identify potential issues or security risks more quickly. for every pair of Server and Other Server, we want the. Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type. I need to be able to return the data sources in the panel EVEN if they return 0 events per data source. Usage. Something like that:Using variables in mvfilter with match or how to get an mvdistinctcount(var) chris. This function takes matching “REGEX” and returns true or false or any given string. For example, in the following picture, I want to get search result of (myfield>44) in one event. Then we could delete the original event, so that no unscrupulous users with access to our Splunk instance could harvest those plaintext passwords. This machine data can come from web applications, sensors, devices or any data created by user. The field "names" can have any or all "tom","dan","harry" but. Your command is not giving me output if field_A have more than 1 values like sr. Neither of these appear to work for me: y=mvfilter (isnotnull (x)) y=mvfilter (!isnull (x)) While this does: y=mvfilter (x!="NULL")) don’t quote me, but I don’t think the REGEX data type in splunk can be replaced with a field value, hence the need to use a subsearch to pass an actual string there Note the value of search needs to be enclosed in " " , so you may need to do an eval before calling return to add the double quotes Solution. Customers Users Wells fargo [email protected]. Removing the last comment of the following search will create a lookup table of all of the values. 0. . You can use this -. Usage of Splunk EVAL Function : MVFILTER . Search for keywords and filter through any data set. Appreciate the training on how to use this forum! Also, you are correct, it's registrationIp through out. If a user is a member of more than one role with search filters applied, all applicable search filters are joined with a Boolean. Only show indicatorName: DETECTED_MALWARE_APP a. 03-08-2015 09:09 PM. Solution. Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you. You can use mvfilter to remove those values you do not want from your multi value field. Now add this to the end of that search and you will see what the guts of your sparkline really is:I'm calculating the time difference between two events by using Transaction and Duration. his example returns true IF AND ONLY IF field matches the basic pattern of an IP address. don’t quote me, but I don’t think the REGEX data type in splunk can be replaced with a field value, hence the need to use a subsearch to pass an actual string there Note the value of search needs to be enclosed in " " , so you may need to do an eval before calling return to add the double quotes Hi all, i want to hide / delete / exclude some keyword like " supersaiyan" , "leave" from the below event using mvfilter. Usage Of Splunk EVAL Function : MVMAP. It showed all the role but not all indexes. if type = 2 then desc = "current". conf, if the event matches the host, source, or source type that. com in order to post comments. I am analyzing the mail tracking log for Exchange. Today, we are going to discuss one of the many functions of the eval command called mvzip. So I found this solution instead. 0 Karma. containers{} | where privileged == "true" With your sample da. The first change condition is working fine but the second one I have where I setting a token with a different value is not. index = test | where location="USA" | stats earliest. | eval mv_Results=mvfilter (mv_B > A) However, this does NOT work. The syntax of the <predicate-expression> is checked before running the search, and an exception is returned for an invalid expression. 01-13-2022 05:00 AM. BrowseHi, I am building a dashboard where I have an multi-select input called locations, which is populated with a query via the dynamic options. Here is a run-anywhere search that generates an "ALIVE" sparklkine (set TimePicker to All time 😞. Try Splunk Enterprise free for 60 days as a hybrid or on-prem download. Browse . segment_status=* | eval abc=mvcount(segment_s. This function is useful for checking for whether or not a field contains a value. mvzipコマンドとmvexpand. we can consider one matching “REGEX” to return true or false or any string. I came quite close to the final desired result by using a combination of eval, forearch and mvfilter. This video shows you both commands in action. And this is the table when I do a top. 05-25-2021 03:22 PM. conf/. com [email protected] better! (^_^)/I'm calculating the time difference between two events by using Transaction and Duration. Now, I want to take the timestamp lets say, 15-5-2017, and iterate down the Time column, and match another row with the same timestamp. This function takes single argument ( X ). Functions of “match” are very similar to case or if functions but, “match” function deals. The first template returns the flow information. JSON array must first be converted to multivalue before you can use mv-functions. Thanks!COVID-19 Response SplunkBase Developers Documentation. Something like that: But the mvfilter does not like fields in the match function if we supply a static string we are ok. I want to calculate the raw size of an array field in JSON. 0 Karma. However it is also possible to pipe incoming search results into the search command. To simplify the development process, I've mocked up the input into a search as so: eventtype=SomeEventType | eval servers="serverName01;serverName02;serverName03" | makemv delim=";" servers |. with. I have a filed called names as shown below, if i search with first line of strings then search returning the complete filed event but not second and third line of filed strings. | eval New_Field=mvfilter(X) Example 1: See full list on docs. status!=SUCCESS doesn't work due to multiple nested JSON fields containing both SUCCESS and FAILURES. 06-28-2021 03:13 PM. COVID-19 Response SplunkBase Developers Documentation. Please try to keep this discussion focused on the content covered in this documentation topic. We help security teams around the globe strengthen operations by providing. In Splunk, it is possible to filter/process on the results of first splunk query and then further filter/process results to get desired output. Similarly your second option to. Numbers are sorted based on the first. 1. My background is SQL and for me left join is all from left data set and all matching from right data set. as you can see, there are multiple indicatorName in a single event. The important part here is that the second column is an mv field. In Bro DNS logs, query and response information is combined into a single event, so there is not Bro. . See Predicate expressions in the SPL2. status=SUCCESS so that only failures are shown in the table. The best way to do is use field extraction and extract NullPointerException to a field and add that field to your search. Set that to 0, and you will filter out all rows which only have negative values. host_type {} contains the middle column. Likei. I realize the splunk doesn't do if/then statements but I thought that was the easiest way to explain. I am trying the get the total counts of CLP in each event. If field has no values , it will return NULL. 02-15-2013 03:00 PM. In splunk docs I read that mvfilter in combination with isnotnull or !isnull functions can be used when you want to return only values that are not NULL from a multivalue field. It could be in IPv4 or IPv6 format. 0. Reply. Customer Stories See why organizations around the world trust Splunk. 1 Found the answer after posting this question, its just using exiting mvfilter function to pull the match resutls. Thank you. net or . Hello all, Trying to figure out how to search or filter based on the matches in my case statement. So the scenarios is like this - I have a search query which gets a web service response in which there is a tag "identifier" and this tags occurs multiple times in the same event with values like like P123456, D123465 etc. I want specifically 2 charac. Results missing a given field are treated as having the smallest or largest possible value of that field if the order is descending or ascending, respectively. | eval mv_Results=mvfilter (mv_B > A) However, this does NOT work. When I did the search to get dnsinfo_hostname=etsiunjour. Neither of these appear to work for me: y=mvfilter (isnotnull (x)) y=mvfilter (!isnull (x)) While this does: y=mvfilter (x!="NULL"))Remove mulitple values from a multivalue field. The classic method to do this is mvexpand together with spath. name {} contains the left column. There might be better ways to do it. . . @abc. BrowseEvaluating content of a list of JSON key/value pairs in search. My search query index="nxs_m. mvzipコマンドとmvexpand. if you're looking to calculate every count of every word, that gets more interesting, but we can. The join command is an inefficient way to combine datasets. Try below searches one by. 8 – MVFILTER(mvfilter) mvfilter() gives the result based on certain conditions applied on it. Process events with ingest-time eval. Each event has a result which is classified as a success or failure. COVID-19 Response SplunkBase Developers Documentation. 1 Karma Reply. Use the mvcount, mvindex, and mvfilter eval functions to evaluate multivalue fields Topic 4 – Analyze Multivalue Data Use the mvsort, mvzip, mvjoin, mvmap, and mvappend eval. Verify whether your detections are available as built-in templates in Microsoft Sentinel: If the built-in rules are sufficient, use built-in rule templates to create rules for your own workspace. 05-18-2010 12:57 PM. . Forwarders have three file input processors:VFind™: The first ever UNIX anti-malware scanner, with a unique heterogeneous design that allows for complete protection, in today’s multi-platform networks. com 123@wf. I'd like to filter a multivalue field to where it will only return results that contain 3 or more values. Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type. 11-15-2020 02:05 AM. Reply. filter ( {'property_name': ['query', 'query_a',. I hope you all enjoy. fr with its resolved_Ip= [90. 05-24-2016 07:32 AM. without the quotes, otherwise Splunk will literally be looking for the string "Type!=Success". I guess also want to figure out if this is the correct way to approach this search. Just ensure your field is multivalue then use mvfilter. 11-15-2020 02:05 AM. Splunk Data Fabric Search. That's not how the data is returned. sjohnson_splunk. There is also could be one or multiple ip addresses. Phantom) >> Enterprise Security >> Splunk Enterprise or Cloud for Security >> Observability >> Or Learn More in Our Blog >>This does not seem to be documented anywhere, but you can use the curly braces to create fields that are based on field values. don’t quote me, but I don’t think the REGEX data type in splunk can be replaced with a field value, hence the need to use a subsearch to pass an actual string there Note the value of search needs to be enclosed in " " , so you may need to do an eval before calling return to add the double quotesComparison and Conditional functions. I would like to remove multiple values from a multi-value field. column2=mvfilter (match (column1,"test")) Share Improve this answer Follow answered Sep 2, 2020 at 1:00 rockstar 87 2 11 Add a comment 0 | eval column2=split (column1,",") | search column2="*test*" Use the mvcount, mvindex, and mvfilter eval functions to evaluate multivalue fields Topic 4 – Analyze Multivalue Data Use the mvsort, mvzip, mvjoin, mvmap, and mvappend eval functions and the mvexpand command to analyze multivalue data Splunk Education Services About Splunk Education mvfilter(<predicate>) This function filters a multivalue field based on a predicate expression. | gentimes start=1/1/17 end=10/1/18 increment=1d | rename starttime AS _time | stats sparkline (count, 2h) AS sparkline. url' @yuanliu - Yeah, mvfilter can reference only one field, the rest should be only string/pattens. To determine the time zone to assign to a timestamp, Splunk software uses the following logic in order of precedence: Use the time zone specified in raw event data (for example, PST, -0800), if present. It believes in offering insightful, educational, and valuable content and it's work reflects that. g. Refer to the screenshot below too; The above is the log for the event. com in order to post comments. The search command is an generating command when it is the first command in the search. log" "Model*" OR "Response*" | transaction traceId startswith="Model" endswith="R. Risk. 2. X can take only one multivalue field at a time. The mvcombine command creates a multivalue version of the field you specify, as well as a single value version of the field. The third column lists the values for each calculation. 02-20-2013 11:49 AM. I am analyzing the mail tracking log for Exchange. The fillnull command replaces null values in all fields with a zero by default. search command usage. Hello Community, I evaluate the values of a single field which comes with values such as: OUT; IN; DENIED and can get counters for each of those values. The first change condition is working fine but the second one I have where I setting a token with a different value is not. key1. value". field_A field_B 1. Contributor. Mvfilter: Eg: mvfilter (eval (x!=userId))I'm not sure what the deal is with mvfind, but would this work?: search X | eval a=mvfilter(eventtype LIKE "network_%") | search a=* | COVID-19 Response SplunkBase Developers Documentation BrowseDoes Splunk support regex look behind and look ahead? Specifically, I have a log that has the following: CN=LastName, FirstName. Y can be constructed using expression. Log in now. don’t quote me, but I don’t think the REGEX data type in splunk can be replaced with a field value, hence the need to use a subsearch to pass an actual string there Note the value of search needs to be enclosed in " " , so you may need to do an eval before calling return to add the double quotes The mvfilter command LOOKS similar to what I want, but in reverse (the mv variables are the regexes, of which any match is a reason to exit the search). When you untable these results, there will be three columns in the output: The first column lists the category IDs. View solution in original post. The expression can reference only one field. I am trying to use look behind to target anything before a comma after the first name and look ahead to. This Splunk search is an example on how to remove unwanted values from multivalue fields using mvfilter. An ingest-time eval is a type of transform that evaluates an expression at index-time. Hello All, i need a help in creating report. I came quite close to the final desired result by using a combination of eval, forearch and mvfilter. April 13, 2022. 300. This Splunk search is an example on how to remove unwanted values from multivalue fields using mvfilter. We could even take action against the event in Splunk by copying it, redacting the password in the src_user field, and placing it in a summary index for further investigation. | eval NEW_FIELD=mvdedup(X) […] トピック1 – 複数値フィールドの概要. Assuming you have a mutivalue field called status the below (untested) code might work. Another great posting by my personal SPL expert in life, David Veuve, on a subject I love. I don't know how to create for loop with break in SPL, please suggest how I achieve this. This function takes single argument ( X ). The syntax is simple: field IN. splunk. See why organizations trust Splunk to help keep their digital systems secure and reliable. Expanding on @richgalloway's answer, you can do this: index=ndx sourcetype=srctp mvfield="foo" | where mvindex (mvfield,0)="foo". "NullPointerException") but want to exclude certain matches (e. Splunk Development. What I want to do is to change the search query when the value is "All". Find below the skeleton of the usage of the function “mvmap” with EVAL : index=_internal. Of course, you can use list in addition to values if your mvzip doesn't work the way you want it to after that. Upload CSV file in "Lookups -> Lookup table files -> Add new". We can also use REGEX expressions to extract values from fields. index = test | where location="USA" | stats earliest. Browse . In the example above, run the following: | eval {aName}=aValue. Splunk Data Stream Processor. COVID-19 Response SplunkBase Developers Documentation. Please try to keep this discussion focused on the content covered in this documentation topic. The mvfilter function works with only one field at. Any help is greatly appreciated. I'm trying to group ldap log values. Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type. spathコマンドを使用して自己記述型データを解釈する. This function filters a multivalue field based on an arbitrary Boolean expression. Also, I include a static option called "ANY" with a value * I have also a token prefix and suffix of double quotes (") and the delimiter of a coma ( , )Suppose I want to find all values in mv_B that are greater than A. The multivalue version is displayed by default. If the role has access to individual indexes, they will show. Sample example below. i understand that there is a 'mvfind ()' command where i could potentially do something like. This is in regards to email querying. I've used the 'addinfo' command to get a min/max time from the time selector, and a striptime () command to evaluate the epoch time of each holiday's date, but when I use the mvfilter command to compare the epoch holiday time and the. COVID-19 Response SplunkBase Developers DocumentationSyntax: <predicate-expression>. Builder. Description: An expression that, when evaluated, returns either TRUE or FALSE. Usage of Splunk Eval Function: MATCH. you can 'remove' all ip addresses starting with a 10. in Following search query we need to pass the value for nonsupporting days dynamically based on the criteria. Then we could delete the original event, so that no unscrupulous users with access to our Splunk instance could harvest those plaintext passwords. In the following Windows event log message field Account Name appears twice with different values. The documentation states the following: mvfilter (X) This function filters a multivalue field based on an arbitrary Boolean expression X. I want to do this for each result in the result set I obtain for: index=something event_name="some other thing" event_type="yet another thing" |table prsnl_name, role, event_name, event_type, _time |. 1 Karma. BrowseUsage of Splunk EVAL Function : MVCOUNT. Your command is not giving me output if field_A have more than 1 values like sr. Splunk Administration; Deployment Architecture1. It won't. Splunk Coalesce command solves the issue by normalizing field names. create(mySearch); Can someone help to understand the issue. g. The fill level shows where the current value is on the value scale. | eval mv_Results=mvfilter (mv_B > A) However, this does NOT work. . Alternatively, add | table _raw count to the end to make it show in the Statistics tab. 10-17-2019 11:44 AM. 2. 02-24-2021 08:43 AM. If you make sure that your lookup values have known delimiters, then you can do it like this. “ match ” is a Splunk eval function. Verify whether your detections are available as built-in templates in Microsoft Sentinel: If the built-in rules are sufficient, use built-in rule templates to create rules for your own workspace. I want to deal the multivalue field to get the counts whch is satisfied the conditions I set. You could compare this against a REST call to the indexes or indexes-extended endpoint to get a starting point. containers{} | where privileged == "true" With your sample da. conf/. . And when the value has categories add the where to the query. If you ignore multivalue fields in your data, you may end up with missing. Splunk Development. . In both templates are the. Splunk Data Fabric Search. Any help would be appreciated 🙂. Hello, I need to evaluate my _time against a list of times output from a lookup table and produce a calculated field "nextPeriodTime" which is the next time after _time. This function takes matching “REGEX” and returns true or false or any given string. Splunk allows you to add all of these logs into a central repository to search across all systems. Multifields search in Splunk without knowing field names. Splunk, Splunk>, Turn Data Into. Path Finder. . If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers. Usage of Splunk EVAL Function : MVCOUNT. Below is the query that I used to get the duration between two events Model and Response host=* sourcetype=** source="*/example. We’ve gathered, in a single place, the tutorials, guides, links and even books to help you get started with Splunk. | search destination_ports=*4135* however that isn't very elegant. The use of printf ensures alphabetical and numerical order are the same. Numbers are sorted before letters. containers {} | spath input=spec. It serves the needs of IT infrastructure by analyzing the logs generated in various processes but it can also analyze any structured or semi-structured data with proper. The second field has the old value of the attribute that's been changed, while the 3rd field has the new value that the attribute has been changed to. I am attempting to build a search that pulls back all logs that have a value in a multi-value field but do not have other values. It's using mvzip to zip up the 3 fields and then filter out only those which do NOT have a - sign at the start, then extracting the fields out again. we can consider one matching “REGEX” to return true or false or any string. How about sourcetype=wordcount | dedup string | rex field=string max_match=10000 "(?<abc>abc)" | eval abc=mvcount(abc) | table abc - this does the count of abc in the string (since abc does not contain itself, it is an easy calculation). The regex is looking for . The Boolean expression can reference ONLY ONE field at. Hi, In excel you can custom filter the cells using a wild card with a question mark. | eval filteredIpAddress=mvfilter (!match (ipAddress, "^10. Splunk Cloud: Find the needle in your haystack of data. Numbers are sorted based on the first. I have this panel display the sum of login failed events from a search string. @abc. Diversity, Equity & Inclusion Learn how we. And you will end up with: aName=Field1 aValue=123 Field1=123 aName=Field1 aValue=234 Field1=234 aName=Field2 aValue=345. i tried with "IN function" , but it is returning me any values inside the function. 54415287320261. 31, 90. Suppose you have data in index foo and extract fields like name, address. This video shows you both commands in action. New to Splunk, need some guidance on how to approach the below: Need to find null values from multivalue field. Use the mvcount, mvindex, and mvfilter eval functions to evaluate Topic 4 – Analymultivalue fieldsze Multivalue Data Use the mvsort, mvzip, mvjoin, mvmap, and mvappend eval functions and the mvexpand command to analyze multivalue data AboutSplunk Education Splunk classes are designed for specific roles such as Splunkcount events in multivalue field. org. Same fields with different values in one event. I am working with IPFix data from a firewall. Mvfilter: Eg: mvfilter (eval (x!=userId))I'm not sure what the deal is with mvfind, but would this work?: search X | eval a=mvfilter(eventtype LIKE "network_%") | search a=* | COVID-19 Response SplunkBase Developers Documentation BrowseHi, I am building a dashboard where I have an multi-select input called locations, which is populated with a query via the dynamic options. Hi, Let's say I can get this table using some Splunk query. Hi, I would like to count the values of a multivalue field by value. トピック1 – 複数値フィールドの概要. Something like values () but limited to one event at a time. For example, the duration as days between the "estimated delivered date" and the "actual delivered date" of a shipping package: If the actual date is "2018-04-13 00:00:00" and the estimated one is "2018-04-15 00:00:00", the result will be . . Given the subject of this post about 'removing' an IP, then mvfilter is also another useful MV function, e. Select the file you uploaded, e. with. Reading the Splunk docs, the mvfind function uses a regex match, yielding the following undesirable behavior: | makeresults | eval my_multival="one,two,three" |. | gentimes start=-1 | eval field1="pink,fluffy,unicorns" | table field1 | makemv field1 delim="," | eval field1_filtered=mvfilter (NOT match (field1,"pink") AND NOT match (field1,"fluffy")) Yes, you can use the "mvfilter" function of the "eval" command. Remove mulitple values from a multivalue field. When I build a report by Account Name it looks like there were two events instead of one, because Splunk is indexing Account Name twice in this case. Return a string value based on the value of a field. If the field is called hyperlinks{}. Data exampleHow Splunk software determines time zones. Update: mvfilter didn't help with the memory.