topic How to extract all unique values from a multivalue field in one event? in Splunk Search

How to extract all unique values from a multivalue field in one event?

edrivera3 — Wed, 15 Apr 2015 17:57:22 GMT

I want to extract field values that are distinct in one event. I managed to extract all the field values in the event, but I don't want those that repeat themselves.

...| rex field=_raw "El color de la casa es (?< color_casa > [a-z]{1,10})" max_match=0

Re: How to extract all unique values from a multivalue field in one event?

acharlieh — Wed, 15 Apr 2015 18:27:41 GMT

Looking at the functions for eval, I would guess that

    ... | rex field=_raw "El color de la casa es (?< color_casa > [a-z]{1,10})" max_match=0 | eval color_casa=mvdedup(color_casa)

should do the trick. If not that then:

    ... | rex field=_raw "El color de la casa es (?< color_casa > [a-z]{1,10})" max_match=0 | eval color_casa=mvdedup(mvsort(color_casa))

Re: How to extract all unique values from a multivalue field in one event?

ngatchasandra — Wed, 15 Apr 2015 18:40:01 GMT

Hi edrivera3,

Try with mvindex function, this will retrieve all values field like follow:

 ...| rex field=_raw "El color de la casa es (?< color_casa > [a-z]{1,10})" max_match=0 |eval color1=mvindex( color_casa,0) |eval color2=mvindex( color_casa,1) |eval color3=mvindex( color_casa,2) |... |table color1 color2 color3 ...

Re: How to extract all unique values from a multivalue field in one event?

edrivera3 — Wed, 15 Apr 2015 22:57:10 GMT

Do you know how I could do the same but with the configuration file? (No inline)

Re: How to extract all unique values from a multivalue field in one event?

edrivera3 — Thu, 16 Apr 2015 14:05:53 GMT

I have more than thirty values in each event and the amount of values is different for each event. Thanks anyway for your answer.

Re: How to extract all unique values from a multivalue field in one event?

acharlieh — Thu, 16 Apr 2015 19:14:47 GMT

Assuming you're using field extraction to create the multivalued field, you may be able to use a calculated field to tweak it's value, but it's something you'd need to play with to know for certain.