https://community.splunk.com/t5/Splunk-Dev/two-values-for-same-id-how-to-get-the-second-value/m-p/490266#M8805 <P>If the format is consistent, you can do this:</P> <PRE><CODE>| rex field=result "\[[\S\W]+\sid=(?&lt;second_id&gt;\d+)" </CODE></PRE> <P>See <A href="https://regex101.com/r/p0RcVe/1">https://regex101.com/r/p0RcVe/1</A> to compare this regex</P> Tue, 26 Nov 2019 15:10:45 GMT wmyersas 2019-11-26T15:10:45Z https://community.splunk.com/t5/Splunk-Dev/two-values-for-same-id-how-to-get-the-second-value/m-p/490264#M8803 <P>I have a result which shows two values for the same Id and I want the value of the second Id in table</P> <P>result<BR /> class=com.something.something .something [id=requestid=7375de3b-b524-4a4d-85e5-c6b7cb0fb7b1 id=201231]<BR /> class=com.something.something .something [id=requestid=70dbdd62-7fd3-4178-a082-f27c0866279a id=151232]<BR /> class=com.something.something .something [id=requestid=34b96d23-1340-4f9a-b518-d95b8ae853a5 id=671235]<BR /> class=com.something.something .something [id=requestid=1845de3b-a524-1a4d-75e5-a1b7bb1fb7b2 id=921239] </P> <P>so I want in result 201231,151232,671235,921239</P> <P>Please help.</P> Tue, 26 Nov 2019 08:21:49 GMT https://community.splunk.com/t5/Splunk-Dev/two-values-for-same-id-how-to-get-the-second-value/m-p/490264#M8803 ravirajaka 2019-11-26T08:21:49Z https://community.splunk.com/t5/Splunk-Dev/two-values-for-same-id-how-to-get-the-second-value/m-p/490265#M8804 <P>@ravirajaka ,</P> <P>Try</P> <PRE><CODE>"base search"|rex field="your fieldname" "\bid=(?&lt;second_id&gt;\d+)" </CODE></PRE> Tue, 26 Nov 2019 09:23:13 GMT https://community.splunk.com/t5/Splunk-Dev/two-values-for-same-id-how-to-get-the-second-value/m-p/490265#M8804 renjith_nair 2019-11-26T09:23:13Z https://community.splunk.com/t5/Splunk-Dev/two-values-for-same-id-how-to-get-the-second-value/m-p/490266#M8805 <P>If the format is consistent, you can do this:</P> <PRE><CODE>| rex field=result "\[[\S\W]+\sid=(?&lt;second_id&gt;\d+)" </CODE></PRE> <P>See <A href="https://regex101.com/r/p0RcVe/1">https://regex101.com/r/p0RcVe/1</A> to compare this regex</P> Tue, 26 Nov 2019 15:10:45 GMT https://community.splunk.com/t5/Splunk-Dev/two-values-for-same-id-how-to-get-the-second-value/m-p/490266#M8805 wmyersas 2019-11-26T15:10:45Z https://community.splunk.com/t5/Splunk-Dev/two-values-for-same-id-how-to-get-the-second-value/m-p/490267#M8806 <P>Set <CODE>KV_MODE = auto</CODE> on your Search Head and then do:</P> <PRE><CODE>... | eval id2=mvindex(id, 1) </CODE></PRE> Tue, 26 Nov 2019 23:58:42 GMT https://community.splunk.com/t5/Splunk-Dev/two-values-for-same-id-how-to-get-the-second-value/m-p/490267#M8806 woodcock 2019-11-26T23:58:42Z