topic Re: Return index position of {someValue} in multi-value field in Splunk Search

Return index position of {someValue} in multi-value field

stjack99 — Thu, 30 Sep 2010 05:52:04 GMT

I'm using transaction to combine events & generate multi-value fields. What I want to do is keep the values of a mv field after the first occurance of some value.

My first guess was to use a command that returned the index position of the value within the mv field, then use mvindex to get what I wanted. Only problem, I don't see a command that let's me search of mvfield and get the location of "value".

Am I missing something? If not, anyone have a workaround?

Just to clarify, if I have the following mv field called Names: john bob fred don

I want to get rid of all values before the 1st occurance of bob. End result would be: bob fred don

Thanks in advance!

Re: Return index position of {someValue} in multi-value field

southeringtonp — Thu, 30 Sep 2010 06:25:23 GMT

One workaround:

host=xxx | search Names="bob" | eval DelimitedNames=mvjoin(Names,";") | rex mode=sed field=DelimitedNames "s/^(.*?;)*bob/bob/" | eval InterestingNames=split(DelimitedNames,";")

Flatten the multi-value field into a text string, then use rex to strip out everything before "bob", and then expand the result back into a multi-value field.

Remove search Names="bob" if you want to preserve all values when bob is not seen at all.

Re: Return index position of {someValue} in multi-value field

ildo — Fri, 04 Mar 2011 01:13:52 GMT

Think that rawKeys have "aaa,bbb,ccc".

in the end result "aaa" positionKey = 0, "bbb" positionKey = 1 and "ccc" positionKey = 2.

Re: Return index position of {someValue} in multi-value field

malvidin — Mon, 03 Aug 2020 12:49:45 GMT

I don't know which version it was introduced in, but mvrange and mvzip can be used.

... | eval keys = split(rawKeys, ",") | eval index_and_key = mvzip(mvrange(0, mvcount(keys)), keys, ",")