topic Re: Display only specific values in a column field in Splunk in Splunk Search

Display only specific values in a column field in Splunk

sudeep5689 — Sun, 10 May 2020 06:19:54 GMT

Hi, I have a list of values getting displayed in one of the columns - Error Messages (for all languages) which i have collected in one row for each of the error code. So is there a way that i can show only the english messages in display with being able to count all the error messages for all languages.

Error Code Message Count
302 Eng, fra 2

200 spa,fra,italian, arabic, eng 5

So i want the o/p as

Error Code Message Count
302 Eng 2

200 eng 5

I tried to use mvindex but its failing since some of the error message come at top while some at last. Please note that i don't want the count to be changed

Re: Display only specific values in a column field in Splunk

martin_mueller — Sun, 10 May 2020 11:22:33 GMT

Use mvfilter(lower(Message) = "eng"), or some other filter to detect English.

Re: Display only specific values in a column field in Splunk

sudeep5689 — Sun, 10 May 2020 11:47:44 GMT

Hi Thanks for your response. But eng is not a fixed word. The error messages are coming in diff languages and m clubing them together as per the error code. Now in the error messages column i dont want to show all the messages from each and every language but just show the english language message. In the response language:eng is coming for english.

Re: Display only specific values in a column field in Splunk

martin_mueller — Sun, 10 May 2020 21:47:58 GMT

You can use any boolean eval expression inside mvfilter(), including regex match().

Re: Display only specific values in a column field in Splunk

sudeep5689 — Mon, 11 May 2020 07:02:34 GMT

Hi Martin,

Thanks but it would be again a difficult taskk since other languages will contain letters as well.

One of the o/p is:
Angef
El estado del contrato solicitado no se recuper
Le statut de contrat demand
O status do contrato solicitado n
Requested status was not retrieved

From above o/p i want to extract the english one which is the last one

Re: Display only specific values in a column field in Splunk

martin_mueller — Mon, 11 May 2020 07:54:33 GMT

I don't think there is a language detection function in Splunk.
Do your original events have a language field?

Re: Display only specific values in a column field in Splunk

sudeep5689 — Mon, 11 May 2020 08:14:03 GMT

Hi, yes in response "language:eng" comes for english language. For spanish it would be "language"spa"

Re: Display only specific values in a column field in Splunk

martin_mueller — Mon, 11 May 2020 09:27:27 GMT

Filter by language:eng then?

Re: Display only specific values in a column field in Splunk

sudeep5689 — Mon, 11 May 2020 09:56:23 GMT

Should i use mvfilter(language:eng)? but this will not work right? Can you pls help me with this and language:eng comes as a separate entity

Re: Display only specific values in a column field in Splunk

martin_mueller — Mon, 11 May 2020 10:00:27 GMT

I can't tell you how to use your data if you don't post your data.

Re: Display only specific values in a column field in Splunk

sudeep5689 — Mon, 11 May 2020 10:28:54 GMT

this is the o/p of one of the field:

Angef
El estado del contrato solicitado no se recuper
Le statut de contrat demand
O status do contrato solicitado n
Requested status was not retrieved

Here i want to show just the last one

Re: Display only specific values in a column field in Splunk

martin_mueller — Mon, 11 May 2020 10:35:13 GMT

I don't see language:eng in there.

Re: Display only specific values in a column field in Splunk

sudeep5689 — Mon, 11 May 2020 10:37:26 GMT

its not in this. its coming as one of the tags in the response

like language:eng LocalizedMessage:

Re: Display only specific values in a column field in Splunk

martin_mueller — Mon, 11 May 2020 10:49:02 GMT

Filter based on that then.