topic Re: How to remove words and characters from a multivalued filed in Splunk Search

How to remove words and characters from a multivalued filed

MeMilo09 — Fri, 19 Nov 2021 08:07:00 GMT

Hello All,

How can I remove words and characters from a multivalued field without using REX?

I have a filed named OS

OS:
Windows-2016
Windows-2010

How can I take out everything that comes in before the hyphen and just end up with the below?

OS:
2016
2010

Re: How to remove words and characters from a multivalued filed

richgalloway — Fri, 19 Nov 2021 13:44:27 GMT

Try mvmap and replace.

| makeresults | eval OS="Windows-2016 Windows-2010" | eval OS=mvmap(OS,replace(OS,"Windows-",""))

Re: How to remove words and characters from a multivalued filed

ITWhisperer — Fri, 19 Nov 2021 15:30:42 GMT

@richgalloway Your example doesn't create a mv-field but your solution works when the field is mv.

| makeresults | eval OS=split("Windows-2016 Windows-2010" ," ") | eval OS=mvmap(OS,replace(OS,"Windows-",""))

Re: How to remove words and characters from a multivalued filed

MeMilo09 — Mon, 22 Nov 2021 22:06:13 GMT

Pretty close, just used mvindex instead. Thanks

| eval OS_Name=split(OSName,"-"), Env=mvindex(OS_Name, 1)