topic Re: How do I refer to the first, nth or last value of a multivalue field? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-I-refer-to-the-first-nth-or-last-value-of-a-multivalue/m-p/9538#M164 <P>Very cool! Are mv fields sorted by time in a transaction?</P> Sat, 30 Jan 2010 04:46:12 GMT hulahoop 2010-01-30T04:46:12Z How do I refer to the first, nth or last value of a multivalue field? https://community.splunk.com/t5/Splunk-Search/How-do-I-refer-to-the-first-nth-or-last-value-of-a-multivalue/m-p/9536#M162 <P>I am using the transaction command to sessionize web access log events and therefore have made referer, uri etc. into multivalue fields. How do I report on the first value of referer? The second page visited? The exit page?</P> Sat, 30 Jan 2010 04:08:03 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-refer-to-the-first-nth-or-last-value-of-a-multivalue/m-p/9536#M162 cfrln 2010-01-30T04:08:03Z Re: How do I refer to the first, nth or last value of a multivalue field? https://community.splunk.com/t5/Splunk-Search/How-do-I-refer-to-the-first-nth-or-last-value-of-a-multivalue/m-p/9537#M163 <P>You can use the mvindex eval function that's described in: <A href="http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions" rel="nofollow">http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions</A></P> <P>As an example: ... | eval second_uri = mvindex(uri, 1) | ...</P> Sat, 30 Jan 2010 04:18:48 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-refer-to-the-first-nth-or-last-value-of-a-multivalue/m-p/9537#M163 Stephen_Sorkin 2010-01-30T04:18:48Z Re: How do I refer to the first, nth or last value of a multivalue field? https://community.splunk.com/t5/Splunk-Search/How-do-I-refer-to-the-first-nth-or-last-value-of-a-multivalue/m-p/9538#M164 <P>Very cool! Are mv fields sorted by time in a transaction?</P> Sat, 30 Jan 2010 04:46:12 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-refer-to-the-first-nth-or-last-value-of-a-multivalue/m-p/9538#M164 hulahoop 2010-01-30T04:46:12Z Re: How do I refer to the first, nth or last value of a multivalue field? https://community.splunk.com/t5/Splunk-Search/How-do-I-refer-to-the-first-nth-or-last-value-of-a-multivalue/m-p/9539#M165 <P>hulahoop, the field value ordering is controlled by the "mvlist" parameter of the "transaction" command: <A href="http://www.splunk.com/base/Documentation/latest/SearchReference/Transaction">http://www.splunk.com/base/Documentation/latest/SearchReference/Transaction</A></P> Mon, 01 Feb 2010 16:29:10 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-refer-to-the-first-nth-or-last-value-of-a-multivalue/m-p/9539#M165 gkanapathy 2010-02-01T16:29:10Z