topic Re: how to fetch upperbound value from Multi-value field in Splunk Search

how to fetch upperbound value from Multi-value field

rsathish47 — Fri, 11 Apr 2014 12:17:34 GMT

Hi All,

I have multi-value field, I need to fetch last that mean upper bound value from Multi-value field. Length of the field will not be same ;(

Please help how to fetch upperbound value from Multi-value field.

Thanks
Sathish R

martin_mueller — Fri, 11 Apr 2014 12:31:51 GMT

Take a look at this:

| stats count | eval mv = "a b c d" | makemv mv | eval last = mvindex(mv, -1)

Calling mvindex(field, -1) will give you the last value regardless of length.

rsathish47 — Fri, 11 Apr 2014 12:38:43 GMT

thanks Marty.. i used like mentioned below

eval sa=mvindex(test,mvcount(test)-1)

martin_mueller — Fri, 11 Apr 2014 12:46:25 GMT

That'll work as well, but is a bit harder to maintain and might run slower too 😛