topic Re: max_match resulting in only unique values in Splunk Search

How to use rex max_match resulting in only unique values

spencerneal — Mon, 27 Jun 2022 14:59:27 GMT

Hello,

I am trying to get a list of values using max_match=5. However I need the results to only return unique values and not just list 5 values regardless of them being duplicates.

| rex max_match=5 (?P<BrandID>(202\d.+?))\"

|table BrandID

Your help and energy is greatly appreciated. 🙂

Thank you,

Spencer Neal

Re: max_match resulting in only unique values

richgalloway — Sun, 26 Jun 2022 00:37:17 GMT

That's not what rex does. It just matches patterns. If you need unique results, then insert the mvdedup function into your query.

```Get all BrandID values``` | rex max_match=0 (?P<BrandID>(202\d.+?))\" ```Filter out duplicate values ``` | eval BrandID=mvdedup(BrandID) ```Keep only the first 5 unique values``` | eval BrandID=mvindex(BrandID, 0 4) | table BrandID

Re: max_match resulting in only unique values

spencerneal — Sun, 26 Jun 2022 23:15:55 GMT

Rich,

Thank you greatly for taking the time to help me out!! :). Your code did the trick!!

Thank you,

Please take care.

Spencer

Re: max_match resulting in only unique values

richgalloway — Mon, 27 Jun 2022 00:30:27 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.