Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

how to use mvfilter to find out three or more evals?

$
0
0
suppose my search like this | eval A1=mvindex(mvfilter(a1="1" OR a2="2" OR a3="3") | eval B1=mvindex(mvfilter(b1="1" OR b2="2" OR b3="3") | eval C1=mvindex(mvfilter(c1="1" OR c2="2" OR c3="3") so here how to filter A1,B1,C1 ? | eval D=mvfilter( A OR B1 OR C1 ) is it correct? if I enter this it's showing error. please tell me answer

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>