topic Re: How can I select only first line of a field to display in Splunk ITSI

How can I select only first line of a field to display

a1bg503461 — Wed, 08 Feb 2023 11:32:18 GMT

I am working on a KPI script and I need to deduplicate lines in the field
Looks like this :

is there an | eval field= substr for first line of field or some regex that can deduplicate my values. Thanks

Re: How can I select only first line of a field to display

ITWhisperer — Wed, 08 Feb 2023 12:16:47 GMT

Are these multi-value fields?

| eval queue=mvindex(queue, 0) | eval value=mvindex(value, 0)

If not, how did you get the values, perhaps they can be dedup'd before this point?

Re: How can I select only first line of a field to display

Farheen — Mon, 13 Feb 2023 04:28:27 GMT

If you are getting these results from stats. You can try using latest function like below. However, it would be easier to address your question if you can share how you got this result.

|stats latest(queue) values(value) by some_other_field

Re: How can I select only first line of a field to display

a1bg503461 — Mon, 13 Feb 2023 07:25:09 GMT

mvindex works, THANKS! my bash script collects the log, I am still investigating why field gets doubled.