topic Re: how can i get two different events individually where both are separated by pipe "|" in the splunk data base. in Splunk Search

how can i get two different events individually where both are separated by pipe "|" in the splunk data base.

annamareddi — Thu, 28 Jul 2016 12:59:43 GMT

i am using splunk to get the logs. we build a data base where 2 or 3 log events are separated by pipe "|" and tagged to single number in data base. while searching for those events for todays occurence, i am getting the first event only, as i am using first of RAW. How to get all the events tagged to that number, if they occur for today

Re: how can i get two different events individually where both are separated by pipe "|" in the splunk data base.

richgalloway — Thu, 28 Jul 2016 14:47:07 GMT

Can you provide a sample event and your current search query?

Re: how can i get two different events individually where both are separated by pipe "|" in the splunk data base.

sundareshr — Thu, 28 Jul 2016 21:34:36 GMT

Instead of first(_raw), try values(_raw) or list(_raw)

Re: how can i get two different events individually where both are separated by pipe "|" in the splunk data base.

annamareddi — Tue, 29 Sep 2020 10:25:53 GMT

example: "regex1|regex2|regex3"
i want to get first instance of regex1 or 2 or 3 or all three(multiple events in the pattern) of the above pattern as they occurred in today's data.

i am using "|stats value (event_pattern) as "unique event", first (_raw) as sample data|"

Re: how can i get two different events individually where both are separated by pipe "|" in the splunk data base.

annamareddi — Tue, 29 Sep 2020 10:25:56 GMT

hi Sundaresh,
i am so thank full for your suggestions. But they are not satisfying my case. please find the below scenario as an example.

example: "regex1|regex2|regex3"
i want to get first instance of regex1 or 2 or 3 or any two or all three(multiple events in the pattern) of the above pattern as they occurred in today's data.

i am using "|stats value (event_pattern) as "unique event", first (_raw) as sample data|"

Re: how can i get two different events individually where both are separated by pipe "|" in the splunk data base.

ryanoconnor — Tue, 29 Sep 2020 10:26:07 GMT

Have you look tried looking into the split command?

index=your_index sourcetype=your_sourcetype | eval regexes = split(_raw, "|") | eval regex1=mvindex(regexes,0)

Re: how can i get two different events individually where both are separated by pipe "|" in the splunk data base.

annamareddi — Wed, 03 Aug 2016 04:20:39 GMT

thank you Ryanoconnor. its working