Is there a way to ignore the 2nd value in a table cell ?

[AKG1_old1]

Hi,

In search query output, we are adding some columns from csv file. Some times there are duplicats entry in csv file. this causing to display multiple values in table cell. Is there a way to remove/ignore duplicate values from table cell ?

[kamlesh_vaghela · Accepted solution]

@agoyal

There are two ways to handle this scenario.

1st: You can change your search by adding eval for multivalue fields. like eval Tags= mvindex(Tags,0).

2nd: Allow matches from transform.conf.

[my_lookup]
filename    = my.csv
max_matches = 1

https://docs.splunk.com/Documentation/Splunk/7.2.0/Knowledge/Addfieldmatchingrulestoyourlookupconfig...

I prefer 2nd one.

Thanks

[AKG1_old1]

Thanks @kamlesh_vaghela !!

Can you please convert ur comment as answer.

[kamlesh_vaghela]

@agoyal

Glad to help you. Please upvote and accept this answer.

Happy Splunking

[AKG1_old1]

Cheers!!