SPL
Remove mulitple values from a multivalue field
Description
This Splunk search is an example on how to remove unwanted values from multivalue fields using mvfilter.
0 0
| gentimes start=-1 | eval field1="pink,fluffy,unicorns" | table field1 | makemv field1 delim="," | eval field1_filtered=mvfilter(NOT match(field1,"pink") AND NOT match(field1,"fluffy"))
Comments
0 total
Be the first to comment on this SPL.
Leave a comment
You must log in to post a comment.