topic Re: Filter Table Output in Splunk Search

How to Filter Table Output?

RahulMisra — Wed, 20 Sep 2023 18:51:46 GMT

I have an output of

index=feds | fillnull value="" | table httpRequest.clientIp labels{}.name

awswaf:clientip:geo:country:US

awswaf:managed:token:absent

awswaf:clientip:geo:region:US-IL

awswaf:managed:aws:bot-control:signal:non_browser_user_agent

wswaf:clientip:geo:country:US

awswaf:managed:token:absent

awswaf:clientip:geo:region:US-IL

awswaf:managed:aws:bot-control:signal:non_browser_user_agent

wswaf:clientip:geo:country:US

awswaf:managed:token:absent

awswaf:clientip:geo:region:US-IL

awswaf:managed:aws:bot-control:signal:non_browser_user_agent

But need to filter "awswaf:managed:aws:bot-control:signal:non_browser_user_agent" on Table output and see the results only on "awswaf:managed:aws:bot-control:signal:non_browser_user_agent"

Re: Filter Table Output

ITWhisperer — Tue, 19 Sep 2023 10:49:51 GMT

If it is always the last item of a multivalue field, you could try something like this

index=feds | fillnull value="" | table httpRequest.clientIp labels{}.name | rename "labels{}.name" as name | eval name=mvindex(name, -1)

Re: Filter Table Output

RahulMisra — Tue, 19 Sep 2023 11:41:38 GMT

not always the last 😞

Re: Filter Table Output

ITWhisperer — Tue, 19 Sep 2023 11:43:24 GMT

Does it always start with "awswaf:managed"? Or is there some other way to recognise the part you want displayed?

Re: Filter Table Output

RahulMisra — Tue, 19 Sep 2023 11:47:59 GMT

Always with that String

Re: Filter Table Output

ITWhisperer — Tue, 19 Sep 2023 15:13:52 GMT

You could try extracting just that part from your events. If you want help doing that, you should share some raw events in a code block </> to preserve formatting.